On September 17, 2026, an attack was disclosed in which threat actors gained access to BigCommerce customer data through a third-party application called Ribon. The attackers obtained access to the application’s API key and used its permissions to access customer data, including names, email addresses, phone numbers, and shipping addresses. The interesting part is that…

On September 14, 2026, a supply chain attack affected Brevo, a CRM and digital marketing platform. Attackers used a compromised Cloudflare API key to inject malicious code into Brevo websites and Brevo scripts embedded in customer websites. For approximately 5.5 hours, visitors to affected websites could be exposed to malicious content that appeared to be…

A domain can be legitimate for years. It can belong to a trusted service, have a clean reputation, and appear in security databases as safe. And then, one day, everything changes. A legitimate domain can be compromised, redirected, or abused as part of a phishing campaign. A previously trusted website can become the delivery point…

It is easy to think of a cyberattack as a technology problem: a compromised system, a breached server, or a locked account. But once an attack succeeds, its impact rarely stays within the IT department. A phishing attack can start with a single click by one employee. But that click can lead to disrupted operations,…

Multi-factor authentication has made it much harder for attackers to take over corporate accounts. But phishing attacks are evolving, and attackers are finding ways to bypass the protection MFA provides. A recent FBI warning about Kali365, a phishing-as-a-service platform targeting Microsoft 365 users, highlights this shift. Attackers Don’t Always Need Your Password Traditional phishing attacks…

When a major company suffers a cyberattack, we often look for the sophisticated part of the story. Was there a zero-day vulnerability? Was ransomware involved? Did attackers exploit a complex technical weakness? Sometimes, the answer is much simpler. Levi Strauss recently disclosed a cybersecurity incident in which an unauthorized third party gained access to its…

For years, phishing attacks were largely based on volume. Attackers sent thousands or even millions of generic messages, hoping that a small percentage of recipients would click, respond, or share sensitive information. But the nature of phishing has changed. Today, many attacks are no longer built around reaching as many people as possible. They are…

When people hear the term Zero-Day, they usually think of a newly discovered software vulnerability – one that has not yet been patched or even identified by the vendor. But the same concept exists in the world of phishing. Here too, there is a “day zero.” The moment a phishing campaign appears for the very…

A few years ago, if you had asked where an organization’s first line of defense was, most people would have pointed to the firewall, the servers, or the corporate network. But the workplace has changed. Today, employees begin their workday in the browser. They open Microsoft 365, collaborate in Teams, join Zoom meetings, communicate through…