Login
Direct Send: How Attackers Weaponize Your Infrastructure Against You
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
Reading view
Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal, Karthikeyan Dharmaraj and Sripathi Kumar
Anatomy of an Agent Tesla BEC Attack: From Inbox to In-Memory Infostealer
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs
By Shikhar Dalela and Jeewan Singh Jalal
The operators named the kit themselves.
Buried inside compromised legitimate websites, the hidden staging directory is sometimes literally called “/.bulletproof”, and the PHP session cookie the kit sets on every visitor is named “bp_redir_sess.” The “bp” stands for bulletproof, which is an unusual degree of candor from a threat actor whose entire design philosophy is concealment.
Inside the OS-Aware Phishing Kit Profiling Your Device
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.
From Inbox to Encryption: How Ransomware Delivery Has Evolved
Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient opened it, encryption followed within hours.
Cybercriminals Are Targeting the FIFA World Cup 2026
Lead Analysts: Jeewan Singh Jalal and Louis Tiley
KnowBe4 ThreatLabs tracked phishing campaign activity from the first week of April through June 22, 2026 — covering the pre-tournament build-up, tournament kickoff and the first twelve days of live match play. Our latest intelligence adds crucial mid-tournament telemetry (June 15-22), a newly identified reply-back campaign track and additional infrastructure intelligence.
