'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
We coined the poisoned tenant attack in 2023; in 2026, someone used it on us
Someone created a fake OpenAI organization using our company's name and invited specific Push employees to join it. Here's what we learned.
Threat research
// Read
Social engineering
59 posts
Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.
Why your training budget belongs in real-time browser security
Organizations spend billions annually on awareness training. Here's why browser-based technical controls can make the difference where training falls short.
Thought leadership
// Read
Why you can't control AI without being in the browser
Why the right browser security tool makes a separate AI visibility and control purchase unnecessary — and how to decide what you actually need.
Thought leadership
// Read
The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever
AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.
Thought leadership
// Read
LLMShare: how attackers are turning AI chatbot pages into malware delivery platforms
How attackers are using shared content features on AI chatbot platforms to deliver malware via pages hosted on legitimate domains, sent via malvertising.
Threat research
// Read
What we learned from 'Security Theater vs. Security That Works' with Matt Johansen
What we learned from sitting down with Matt Johansen to discuss the difference between security theater and security that actually works.
Thought leadership
// Read
Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt
Here are 7 things we learned from our conversation with Troy Hunt on the "Yes, you've been pwned" webinar.
Thought leadership
// Read
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
7 things we learned from ‘Why the browser is the new battleground’ with John Hammond
Here are 7 things we learned from our conversation with John Hammond on the "Why the browser is the new battleground" webinar.
Thought leadership
// Read
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
We infiltrated a criminal phishing panel: here’s what we found
We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.
Threat research
// Read
ConsentFix v3: Analyzing a new criminal toolkit
Investigating a new criminal toolkit for ConsentFix being promoted on criminal forums.
Threat research
// Read
Guide: How to use Push controls to protect your users from modern browser threats
How to use in-browser controls to stop browser-based attacks before compromise can occur
Guide
// Read
Device code phishing attacks have skyrocketed: here’s what you need to know
Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.
Threat research
// Read
Attackers are now targeting business TikTok accounts using session-stealing phishing kits
Investigating a new wave of AITM phishing pages designed to hijack TikTok accounts.
Threat research
// Read
The Stryker breach didn't match the playbook. That shouldn't be a surprise.
Analysing the Stryker breach in line with recent changes to the Iran-nexus cyber playbook.
Breach analysis
// Read
InstallFix: How attackers are weaponizing malvertised install guides
Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.
Threat research
// Read
Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts
Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.
Threat research
// Read
ConsentFix debrief: latest community insights, recommendations, and predictions
New insights on the ConsentFix campaign stopped by Push.
Threat research
// Read
How cyber criminals power malvertising scams with stolen accounts
Attackers are going out of their way to target Google Ad Manager accounts, powering malvertising scams. Here’s what you need to know.
Threat research
// Read
Taking the fight to attackers: Push’s top features of 2025
Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.
Product feature
// Read
2025’s top phishing trends — and what they mean for your 2026 security strategy
Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026.
Thought leadership
// Read
Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts
Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures.
Threat research
// Read
"Scattered Lapsus$ Hunters" — how modern attackers exploit the gaps in your security stack
How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.
Threat research
// Read
The most advanced ClickFix yet?
Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks.
Threat research
// Read
New phishing campaign identified targeting LinkedIn users
Diving into the latest sophisticated LinkedIn phishing campaign intercepted by Push.
Threat research
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
Why attackers are moving beyond email-based phishing
Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams.
Thought leadership
// Read
How Push stopped a high risk LinkedIn spear-phishing attack against a company exec
How Push saved a company exec from a sophisticated Attacker-in-the-Middle phishing attack delivered via a LinkedIn direct message.
Threat research
// Read
6 browser-based attacks every security team should be prepared for
What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.
Thought leadership
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
How attackers are using Active Directory Federation Services to phish with legit office.com links
Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.
Threat research
// Read
Introducing our guide to phishing detection evasion techniques
Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection.
Guide
// Read
3 key takeaways from the Scattered Spider attacks on aviation & insurance firms
Scattered Spider continues to dominate the headlines, with attacks on aviation and insurance companies worldwide.
Breach analysis
// Read
Scattered Spider: Understanding help desk scams and how to defend your organization
Scattered Spider has dominated the headlines in recent months with a consistent focus on help desk scams. Here's what you need to know to protect your business.
Threat research
// Read
App-Specific Password phishing: another novel way to get around passkeys and MFA
How App-Specific Password phishing is being used in the wild to bypass phishing-resistant authentication controls like passkeys.
Threat research
// Read
A simple, browser-based way to protect your help desk against social engineering
Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.
Product feature
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
5 ways attackers can use Computer-Using Agents to automate identity attacks
We're back with part 2 of our research into OpenAI Operator to share our findings on how it can be used to automate identity attacks.
Threat research
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
Guide to secure browser extension deployment
How extension developers can improve their security controls to prevent extension compromise.
Guide
// Read
Looking back on identity-based breaches in 2024
Reviewing public breaches that stemmed from identity attacks in 2024.
Breach analysis
// Read
A new class of phishing: Verification phishing and cross-IdP impersonation
How phishing for email verification can be combined with cross-IdP impersonation to gain direct access to downstream SaaS and bypass hardened IdP accounts.
Threat research
// Read
Cross-IdP impersonation: Hijacking SSO to access downstream apps
Cross-IdP impersonation is a method of hijacking SSO to access downstream apps — without needing to compromise accounts on your company’s main IdP.
Threat research
// Read
The SaaS attack matrix: A year in review
It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed.
Threat research
// Read
What the rise of infostealers says about identity attacks
What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks.
Threat research
// Read
Phishing 2.0 – how phishing toolkits are evolving with AitM
Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.
Threat research
// Read
Introducing SSO Password Protection: Stop employees’ IdP credentials being exposed or phished
Use the Push browser agent’s unique vantage point to protect SSO credentials by blocking employees from entering their password into any other site.
Product feature
// Read
Tracking identity-based attacks in the wild
To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.
Threat research
// Read
Phishing Microsoft Teams for initial access
In this article, we will cover a number of spoofing and phishing strategies that can be employed by external attackers to target an organization using Teams.
Threat research
// Read
Oktajacking
In this article, we'll show you how to use Okta to do keylogging for you, without needing to have your own malicious domain hosting your malicious SAML server.
Threat research
// Read
Slack Attack: A phisher's guide to persistence and lateral movement
In this post, we're going to demonstrate how to phish via Slack to gain persistence and move laterally.
Threat research
// Read
Slack Attack: A phisher's guide to initial access
In this article, we’ll demonstrate how IM apps, specifically Slack, are an increasingly attractive target for a range of phishing & social engineering attacks.
Threat research
// Read
SAMLjacking a poisoned tenant
In this article, we’re going to demo combining two of our favorite new SaaS attack techniques to make a simple, but effective attack chain.
Threat research
// Read
Let’s talk about SaaS attack techniques
Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.
Threat research
// Read
Embrace SaaS to move faster than your competitors
Look at enabling SaaS from a broader understanding of the business and not just the impact to security
Thought leadership
// Read
How to kick off an incident response investigation for a compromised SaaS account
We'll walk through how to quickly detect and mitigate business email compromise (BEC) and then prevent future attacks.
Guide
// Read
Case study: Business Email Compromise (BEC) attack nearly cost us millions
A story by the owner of an Engineering company on how they almost lost millions from a Business Email Compromise (BEC) style attack. An interesting BEC example.
Breach analysis
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.