'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Troy Hunt webinar recap: Lessons from 'Yes, you've been pwned' with Troy Hunt
Here are 7 things we learned from our conversation with Troy Hunt on the "Yes, you've been pwned" webinar.
Thought leadership
// Read
Threat landscape
48 posts
The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
7 things Omdia's latest report tells us about the secure enterprise browser market
Unpacking the latest research report from Omdia and what it means for the secure enterprise browser market.
Thought leadership
// Read
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
Introducing the Browser & Identity Attacks Matrix
We're re-releasing the SaaS attack matrix as the Browser & Identity Attacks Matrix. Here's why we've decided to make the change and what it means.
Thought leadership
// Read
Browser sync attacks: Where personal account hacks lead to corporate breaches
Browser sync attacks result in business credentials being compromised via personal account and device breaches. Here's what you need to know.
Threat research
// Read
Device code phishing attacks have skyrocketed: here’s what you need to know
Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.
Threat research
// Read
Attackers are now targeting business TikTok accounts using session-stealing phishing kits
Investigating a new wave of AITM phishing pages designed to hijack TikTok accounts.
Threat research
// Read
The Stryker breach didn't match the playbook. That shouldn't be a surprise.
Analysing the Stryker breach in line with recent changes to the Iran-nexus cyber playbook.
Breach analysis
// Read
InstallFix: How attackers are weaponizing malvertised install guides
Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.
Threat research
// Read
Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts
Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.
Threat research
// Read
ConsentFix debrief: latest community insights, recommendations, and predictions
New insights on the ConsentFix campaign stopped by Push.
Threat research
// Read
How cyber criminals power malvertising scams with stolen accounts
Attackers are going out of their way to target Google Ad Manager accounts, powering malvertising scams. Here’s what you need to know.
Threat research
// Read
Taking the fight to attackers: Push’s top features of 2025
Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.
Product feature
// Read
2025’s top phishing trends — and what they mean for your 2026 security strategy
Analyzing the key trends that defined phishing attacks in 2025, and what these changes mean for security teams heading into 2026.
Thought leadership
// Read
Uncovering a Calendly-themed phishing campaign targeting business ad manager accounts
Investigating a phishing campaign targeting Google Ads Manager MCC accounts to propagate malvertising lures.
Threat research
// Read
Analyzing the latest Sneaky2FA Browser-in-the-Browser phishing page
Analyzing a BITB phishing page linked to the Sneaky2FA Phishing-as-a-Service operation.
Threat research
// Read
"Scattered Lapsus$ Hunters" — how modern attackers exploit the gaps in your security stack
How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.
Threat research
// Read
The most advanced ClickFix yet?
Breaking down the most sophisticated ClickFix page we’ve seen in the wild — and what it tells us about the future of malicious copy-and-paste attacks.
Threat research
// Read
Introducing malicious copy and paste detection
Push now detects malware delivery in the browser, supporting a layered defense against endpoint attacks.
Product feature
// Read
Why attackers are moving beyond email-based phishing
Why phishing attacks are moving away from exclusively email-based delivery, and what this means for security teams.
Thought leadership
// Read
6 browser-based attacks every security team should be prepared for
What security teams need to know about the browser-based attack techniques that are the leading cause of breaches.
Thought leadership
// Read
How the browser became the main cyber battleground
How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.
Thought leadership
// Read
Introducing our guide to phishing detection evasion techniques
Introducing our latest resource for security teams breaking down the techniques that modern phishing attacks are using to evade detection.
Guide
// Read
Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks
We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows.
Product feature
// Read
3 key takeaways from the Scattered Spider attacks on aviation & insurance firms
Scattered Spider continues to dominate the headlines, with attacks on aviation and insurance companies worldwide.
Breach analysis
// Read
Scattered Spider: Understanding help desk scams and how to defend your organization
Scattered Spider has dominated the headlines in recent months with a consistent focus on help desk scams. Here's what you need to know to protect your business.
Threat research
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
Series B and Beyond: Securing the New Perimeter
I’m thrilled to share that Push Security has raised our Series B funding. This is a huge moment for us and our customers in the fight against identity attacks.
Company news
// Read
Dissecting a recent MailChimp phishing attack
HIBP creator and well-known security person Troy Hunt recently blogged about a phish he fell for. Here’s what it tells us about how phishing is evolving.
Breach analysis
// Read
6 breaches in 5 months: Why attackers are targeting Jira with stolen credentials
Attackers are persistently targeting Jira accounts with stolen credentials. What can we learn from this trend?
Breach analysis
// Read
5 ways attackers can use Computer-Using Agents to automate identity attacks
We're back with part 2 of our research into OpenAI Operator to share our findings on how it can be used to automate identity attacks.
Threat research
// Read
How new AI agents will transform credential stuffing attacks
Credential stuffing attacks had a huge impact in 2024. But things could be dialled up even further with Computer-Using Agents like OpenAI Operator.
Threat research
// Read
Considering the security implications of Computer-Using Agents (like OpenAI Operator)
CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.
Threat research
// Read
Looking back on identity-based breaches in 2024
Reviewing public breaches that stemmed from identity attacks in 2024.
Breach analysis
// Read
Snowflake: Looking back on 2024’s landmark security event
165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people.
Breach analysis
// Read
What we can learn from the recent ServiceNow/Microsoft disclosure
Account takeover on third-party apps is the flavor of the month for security researchers — what can we learn from it?
Breach analysis
// Read
The SaaS attack matrix: A year in review
It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed.
Threat research
// Read
Our design philosophy: Detecting what matters
This is the first blog in a short series we’re putting together about the ‘why’ behind the ‘what’ at Push. This entry is focused on threat detection.
Thought leadership
// Read
What the rise of infostealers says about identity attacks
What the rise in popularity of infostealers tells us about the cybercrime ecosystem and the shift toward identity attacks.
Threat research
// Read
Tracking identity-based attacks in the wild
To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.
Threat research
// Read
5 ways to defeat identity-based attacks
In this blog post we will cover what identities are, how we secure perimeters in general, and and how this maps to the identity space.
Thought leadership
// Read
6 surprising takeaways from a recent report on identity-based attacks
A new report on securing digital identities has some interesting takeaways to consider as we think about securing identities in the cloud. Here's our take.
Thought leadership
// Read
Credential stuffing: The most common attack against SaaS identities
Credential stuffing attacks are incredibly common, but they often go undetected. These attacks are often the entry point for attack. Learn how to prevent them.
Guide
// Read
Let’s talk about SaaS attack techniques
Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face.
Threat research
// Read
SaaS sprawl isn't a problem - if you completely change your approach
Employees using a new work app used to be the final step of the software-onboarding process. Now it's the first. Security must adapt to secure business data.
Thought leadership
// Read
Embrace SaaS to move faster than your competitors
Look at enabling SaaS from a broader understanding of the business and not just the impact to security
Thought leadership
// Read
Maintaining persistent access in a SaaS-first world
Attackers have loads of persistence options in an endpoint compromise scenario, but what changes in a SaaS-first world? We talk new attack methods in this post.
Threat research
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.