'%3e%3cpath%20d='M248.027%20159.993C292.176%20159.993%20328.105%20124.1%20328.105%2079.996C328.105%2035.892%20292.191%200%20248.027%200C203.863%200%20167.95%2035.892%20167.95%2079.996C167.949%20124.101%20203.878%20159.993%20248.027%20159.993ZM213.969%2045.973C223.069%2036.882%20235.155%2031.873%20248.027%2031.873C260.899%2031.873%20272.986%2036.882%20282.086%2045.973C291.186%2055.064%20296.2%2067.154%20296.2%2079.997C296.2%2092.84%20291.186%20104.93%20282.086%20114.021C272.986%20123.112%20260.899%20128.12%20248.027%20128.12C235.155%20128.12%20223.069%20123.111%20213.969%20114.021C204.869%20104.93%20199.871%2092.84%20199.871%2079.997C199.871%2067.154%20204.884%2055.063%20213.969%2045.973Z'%20fill='%23EE4323'/%3e%3cpath%20d='M150.16%200L57.6821%20159.993H94.5381L187%200H150.16Z'%20fill='%23EE4323'/%3e%3cpath%20d='M92.478%200L0%20159.993H36.856L129.334%200H92.478Z'%20fill='%23EE4323'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_296_834'%3e%3crect%20width='328.105'%20height='159.993'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e){kind=small}
Browser threat landscape: mid-year update 2026
PhaaS industrialization, Scattered Spider copycats, and AI-augmented tooling — what the threat landscape looks like in 2026 so far.
Thought leadership
// Read
Vishing
16 posts
Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.
The Pyramid of Pain in the AI era: Why technique-level detection matters more than ever
AI is accelerating the collapse of indicator-based threat detection. Here's why you need technique-level detection to stay ahead.
Thought leadership
// Read
What the Verizon DBIR tells us about how breaches happen in 2026
What we can learn from 2026's installment of the Verizon Data Breach Investigations Report.
Thought leadership
// Read
The three attack techniques behind ShinyHunters' 2026 campaigns
ShinyHunters' breach of Instructure is the latest in a long series of attacks. Here's our view of the big picture.
Threat research
// Read
We infiltrated a criminal phishing panel: here’s what we found
We got an inside look at a phishing panel used in criminal campaigns linked to operators like ShinyHunters and BlackFile. Here’s what we found.
Threat research
// Read
Device code phishing attacks have skyrocketed: here’s what you need to know
Device code phishing is seeing a huge spike in adoption in 2026, enabling attackers to steal access tokens while bypassing standard access controls.
Threat research
// Read
The Stryker breach didn't match the playbook. That shouldn't be a surprise.
Analysing the Stryker breach in line with recent changes to the Iran-nexus cyber playbook.
Breach analysis
// Read
Unpacking the latest SLH campaign — combining vishing with AiTM phishing to hijack SSO accounts
Analyzing the latest Scattered Lapsus$ Hunters (SLH) phishing campaign targeting hundreds of organizations.
Threat research
// Read
Taking the fight to attackers: Push’s top features of 2025
Here’s how real-world attacks and our own R&D informed what we built for Push customers over the last year.
Product feature
// Read
"Scattered Lapsus$ Hunters" — how modern attackers exploit the gaps in your security stack
How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.
Threat research
// Read
3 key takeaways from the Scattered Spider attacks on aviation & insurance firms
Scattered Spider continues to dominate the headlines, with attacks on aviation and insurance companies worldwide.
Breach analysis
// Read
Scattered Spider: Understanding help desk scams and how to defend your organization
Scattered Spider has dominated the headlines in recent months with a consistent focus on help desk scams. Here's what you need to know to protect your business.
Threat research
// Read
A simple, browser-based way to protect your help desk against social engineering
Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.
Product feature
// Read
Scattered Spider: TTP evolution in 2025
How the notorious Scattered Spider cyber criminal group are switching up their TTPs in 2025 to bypass MFA and breach cloud services via account takeover.
Threat research
// Read
Tracking identity-based attacks in the wild
To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.
Threat research
// Read
Subscribe to get updates from Push
The latest news, articles, and resources, sent to your inbox.