Webinar - On Demand

Threat research webinar: The State of Shadow AI

Join the latest webinar from Push Security Field CTO Mark Orlando, analysing the different dimensions of shadow AI we see in customer environments and what you can do about it.

Mark OrlandoField CTO

Got questions for John or Luke?

Agenda: The State of Shadow AI

Most AI policies sanction one or two platforms. What's actually in use across the workforce is a different story: AI apps, browser extensions, and OAuth integrations accumulating faster than any approval process can track, mostly self-adopted, unapproved, and invisible to security and IT teams.

That gap isn't created by rogue employees. It's created by four ordinary behaviors: signing up for an AI tool that looks useful, logging into an approved one with a personal account, installing a browser extension, and clicking "Allow" on an OAuth consent screen.

Attackers have noticed. The same behaviors driving AI adoption are enabling attacks.

Insecure personal accounts get compromised on personal devices and take corporate data with them. Imitation extensions branded as official AI companions ship with permissions to read everything in the browser. Malicious OAuth grants become hidden backdoors in tenants where LLM connections are already normal activity. And compromised AI vendors turn forgotten integrations into breach paths.

Join Push Security Field CTO Mark Orlando to learn the real state of AI adoption

Agenda: Why the Browser is the New Battleground

The browser is the new endpoint, and it's under attack. Attacks are happening entirely inside the browser sandbox, targeting applications directly over the internet, and blending in with legitimate web and network traffic, application access, and user activity. This is a significant challenge for security teams. Existing security tools can't get visibility of what's happening inside the browser. Attackers know this, and are ruthlessly exploiting the browser blindspot. This is fuelling a lot of attacker innovation, with new tools and techniques constantly emerging. Push Security VP R&D Luke Jennings is joined by John Hammond, Senior Principal Security Researcher at Huntress, to demonstrate the latest browser-based attack techniques. Ride along with Luke and John as they analyse real-world attacks, covering:

ConsentFix, the browser-native ClickFix attack linked to Russian APTs
Session-stealing, MFA-bypassing phishing campaigns targeting enterprises over LinkedIn and Google Ads
The latest social engineering tradecraft and detection evasion techniques
What the future of browser-based attacks looks like and what security teams can do about it

Luke JenningsVP Research

Got questions for John or Luke?

Trusted by: