LoginDirect Send: How Attackers Weaponize Your Infrastructure Against You
10 September 2026 at 07:00
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
Normal view
Before yesterdayKnowBe4 Security
-
KnowBe4 Security
- Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy
Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy
4 September 2026 at 16:00
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension
28 August 2026 at 13:30
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal, Karthikeyan Dharmaraj and Sripathi Kumar
Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer
20 August 2026 at 09:00
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs
10 August 2026 at 12:00
By Shikhar Dalela and Jeewan Singh Jalal
The operators named the kit themselves.
Buried inside compromised legitimate websites, the hidden staging directory is sometimes literally called “/.bulletproof”, and the PHP session cookie the kit sets on every visitor is named “bp_redir_sess.” The “bp” stands for bulletproof, which is an unusual degree of candor from a threat actor whose entire design philosophy is concealment.
Inside the OS-Aware Phishing Kit Profiling Your Device
30 July 2026 at 09:00
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.
From Inbox to Encryption: How Ransomware Delivery Has Evolved
23 July 2026 at 10:00
Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient opened it, encryption followed within hours.
Cybercriminals Are Targeting the FIFA World Cup 2026
2 July 2026 at 09:00
Lead Analysts: Jeewan Singh Jalal and Louis Tiley
KnowBe4 ThreatLabs tracked phishing campaign activity from the first week of April through June 22, 2026 — covering the pre-tournament build-up, tournament kickoff and the first twelve days of live match play. Our latest intelligence adds crucial mid-tournament telemetry (June 15-22), a newly identified reply-back campaign track and additional infrastructure intelligence.
