QQnayds Seo·15h agoWhat Is Phishing? How to Identify and Avoid Online ScamsLearn what phishing is,common types of phishing attacks, how to identify suspicious messages,and practical tips to protect yourself from online scams.5 min read·qnayds.hashnode.dev
SSedat Pehlivantürk·5d agoHow Phishing Exploits Search: SEO Poisoning and CloakingIt sounds like an exaggeration. It isn’t. A brand search feels safe precisely because the results almost never change — and that stability is exactly what an attacker exploits. In this article I’ll wa7 min read·sedatpehlivanturk.hashnode.dev
VVũ Nhật Lâm·6d agoA Fake Meta Interview Slot: Cloned Calendly Pages That Take the Password and the 2FA Code in Real TimeSummary Malwarebytes found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a "recruiter", fill in their details, pa11 min read·blog.fiscybersec.com
JJaden Vo·Nov 4Spot Lookalike Phishing Domains in Python: Punycode, Homoglyphs and Typos in ~140 Lines of StdlibDecode xn-- labels, catch mixed Cyrillic/Latin names, compare "skeletons" against a watchlist and fail CI on a hit, with a tested script and unit tests9 min read·jadenvo259.hashnode.dev22FD
CCyber Knight·Nov 3The AI Agent Didn't Break the Product. It Walked Into the Sales Tool.WorkOS builds the login layer for thousands of companies. The breach it disclosed on 2 November didn't touch that product — it reached an internal sales app instead, and what that app held is exactly what makes the next phishing email believable.5 min read·nulltrace.hashnode.dev
KKazem Mortazavi·Nov 2Why Business Email Compromise Slips Past Signature-Based Email FiltersA finance manager receives a short email that appears to come from the CEO: "Wire this amount to this account before noon. I'm in a meeting and can't take calls." No attachment, no link. No antivirus2 min read·securityland.hashnode.dev
4404 Founders·Oct 31Microsoft 365 Token Spraying Hit 79 Orgs Without a PasswordHuntress tracked stolen session tokens replayed into 79 organizations. The noisiest tenants were the safe ones.12 min read·404-founders.com1
MMahir Faysal·Oct 29How to Check if a QR Code Is Safe Before You Scan It (iPhone, Android, UK and US)Spot fake QR codes before they cost you: preview the link, read the domain, scan it with a free checker, and know what to do if you already tapped it.17 min read·mfaysaldev.hashnode.dev11F
FFurqan Ashraf·Oct 28Your Browser Won't Catch Every Fake Domain. Here's How to Check One YourselfChrome 154 can miss lookalike domains. Check any suspicious domain with Punycode, RDAP and DNS, using free commands and a script you can run in 5 min.8 min read·furqanashraf.hashnode.dev2
CCyber Knight·Oct 27The Help Desk That Wasn't There: How a Teams Message Became Ransomware in Under 17 HoursNo vulnerability. No malicious link. Just a chat window, a friendly name, and a six-digit code — and Arctic Wolf counted more than 400 cases.5 min read·nulltrace.hashnode.dev11F
