Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

knowbe4

New ConsentFix Technique Tricks Users Into Handing Over OAuth Tokens

Dec 30, 2025 By KnowBe4 Team In KnowBe4
Researchers at Push Security have observed a new variant of the ClickFix attack that combines “OAuth consent phishing with a ClickFix-style user prompt that leads to account compromise.” The technique, which the researchers call “ConsentFix,” tricks victims into copying and pasting a localhost URL containing an authorization token, then pasting it into a phishing page.
Read Post
knowbe4

Most Parked Domains Lead Users to Scams or Malware

Dec 29, 2025 By KnowBe4 Team In KnowBe4
Over 90% of parked domains now direct users to malicious content, compared to less than 5% a decade ago, according to researchers at Infoblox. “Parking threats are fueled by lookalike domains,” Infoblox explained. “No domain is immune. When one of our researchers tried to report a crime to the FBI’s Internet Crime Complaint Center (IC3), they accidentally visited ic3gov. Their phone was quickly redirected to a false “Drive Subscription Expired” page.
Read Post

When to Contact Your Bank About a Suspicious Charge

Dec 26, 2025 By KnowBe4 | Human Risk Management In KnowBe4
Fraud doesn’t start big. It starts quiet. Those small, unfamiliar charges (even $1) are often “test” charges scammers use to see what they can get away with. Contact your bank if: You see a charge you don’t recognize (even a small one) Your card suddenly declines mid-purchase You get alerts or texts about “unusual activity” Always verify through your bank’s official app or by calling the number on the back of your card.
View Video
knowbe4

New BlackForce Phishing Kit Bypasses Multifactor Authentication

Dec 22, 2025 By KnowBe4 Team In KnowBe4
Zscaler has published a report on a new phishing kit dubbed “BlackForce” that uses Man-in-the-Browser (MitB) attacks to steal credentials and bypass multi-factor authentication. Notably, the kit “features a vetting system to qualify targets, after which a live operator takes over to orchestrate a guided compromise.” Additionally, the phishing kit uses mostly legitimate code in order to avoid detection by security scanners.
Read Post
knowbe4

81% of Small Businesses Sustained a Cyber Incident Over the Past Year

Dec 19, 2025 By KnowBe4 Team In KnowBe4
Eighty-one percent of small businesses suffered a security or data breach over the past year, and 38% of these businesses were forced to raise their prices as a result, a report from the Identity Theft Resource Center (ITRC) has found. The report notes that external hackers have overtaken malicious insiders as the most common root cause of these incidents. This trend is partially driven by AI-assisted social engineering attacks, which were cited as a root cause by more than 41% of victims.
Read Post
knowbe4

WeChat Phishing Attacks a Growing Threat Outside China

Dec 18, 2025 By KnowBe4 Threat Lab In KnowBe4
“Super-app” WeChat offers a wealth of functionality—from instant messaging, text and voice messaging, and video calls to mobile payments, ride booking, ordering food deliveries, paying bills and even accessing government services. Provided by Chinese technology conglomerate Tencent, WeChat has become deeply integrated into daily life in China and usage has been spreading globally. The app now boasts over 1.4 billion active users (24.8% of total internet users).
Read Post
knowbe4

Unmasking the Deepfake Threat: A Game-Changer for Reducing Human Risk

Dec 18, 2025 By Roger Grimes In KnowBe4
Today, anyone can find a picture of absolutely anybody and it is also not difficult to find a sample of their voice. By combining these it is shockingly easy to create a realistic AI deepfake video of that person. The video may not be perfect, and an experienced AI deepfake enthusiast might be able to see signs of it not being real, but it will be good enough to fool 99% of people. Cybercriminals have been creating and using AI-enabled deepfake technologies since early 2024 to socially engineer people.
Read Post
knowbe4

Mexico Unveils Its First National Cybersecurity Plan: A New Era of Digital Resilience

Dec 17, 2025 By Erich Kron In KnowBe4
Mexico has taken a major step toward strengthening its digital defenses with the official unveiling of its first National Cybersecurity Plan, a landmark initiative that establishes the country’s first specialized policy framework for cybersecurity.
Read Post
knowbe4

Phishing Campaign Targets Executives With Phony Awards

Dec 16, 2025 By KnowBe4 Team In KnowBe4
A phishing campaign is targeting executives with phony offers for awards, according to researchers at Trustwave SpiderLabs. The attackers first dupe the victims into handing over their credentials, then use the ClickFix social engineering technique to trick them into installing malware. “The campaign uses a high-value executive recognition lure, ‘Cartier Recognition Program,’ to target executives,” the researchers write.
Read Post

FAIK Everything: The Deepfake Training Playbook

Dec 16, 2025 By KnowBe4 | Human Risk Management In KnowBe4
Learn how to understand, combat, and even create synthetic media in this essential deepfake training session with Perry Carpenter, KnowBe4's Chief Human Risk Management Strategist. Deepfakes and synthetic media are no longer futuristic threats—they are here now, and organizations are already experiencing deepfake-related attacks. A May 2024 study showed that 25.9% of organizations have experienced deepfake-related attacks, with other indicators suggesting the number may be closer to 90%. It is high time to prepare people to deal with this evolving threat.
View Video
knowbe4

[Heads Up] Crafty New Phishing Attacks Abuse Free Cloudflare Pages

Dec 15, 2025 By KnowBe4 Team In KnowBe4
Malwarebytes warns that threat actors are abusing the free Cloudflare Pages service to host phishing portals, helping the phishing sites avoid detection by security scanners. The attackers are building fake login pages impersonating banking, insurance, and healthcare entities. The pages are designed to harvest credentials as well as security questions and multifactor authentication codes.
Read Post
knowbe4

Deepfake Training: A Strategic Advantage Against Emerging Threats

Dec 15, 2025 By KnowBe4 Team In KnowBe4
Deepfake attacks have become more compelling and realistic than ever before. Attackers are impersonating trusted leaders with convincing videos and voice, making it harder for employees to know what is real. Traditional awareness training is a good start, but nothing replaces first-hand exposure to real and synthetic content when it comes to telling deepfake videos from authentic ones. That’s why today we’re introducing KnowBe4’s Deepfake Training Content.
Read Post
knowbe4

Report: Phishing Has Surged 400% Year-Over-Year

Dec 10, 2025 By KnowBe4 Team In KnowBe4
Researchers at SpyCloud have observed a 400% year-over-year increase in successful phishing attacks, with a disproportionate number of attacks targeting corporate accounts. “The company tracked a 400% year-over-year increase in successfully phished identities, with nearly 40% of the 28+ million recaptured phished records containing a business email address – compared to just 11.5% in recaptured malware data,” the researchers write.
Read Post
knowbe4

Social Engineering Campaign Targets Microsoft Teams Users

Dec 10, 2025 By KnowBe4 Team In KnowBe4
Researchers at CyberProof warn that threat actors are launching phishing attacks via Microsoft Teams' “Chat with Anyone” feature, which lets external users send direct messages via email addresses. “Microsoft Teams now allows users to send direct chat invitations to any email address, even if recipients aren’t part of a Teams tenant,” the researchers explain.
Read Post

Your Digital Footprint and Why it Matters!

Dec 10, 2025 By KnowBe4 | Human Risk Management In KnowBe4
You know that trail of bread crumbs you leave across the internet? Cybercriminals love to eat them up! Every post. Every like. Every old username from 2012, it all sticks around. And scammers can use that info to guess passwords, target you, or piece together your whole life story. So post smart. Share less. Protect more.
View Video
knowbe4

Warning: Phishing Campaign Leveraging Evilginx Targets U.S. Universities

Dec 9, 2025 By KnowBe4 Team In KnowBe4
Threat actors are using the open-source phishing framework Evilginx to target universities across the United States, according to researchers at Infoblox. The attackers have targeted at least 18 universities and educational entities since April 2025, using phishing pages that spoofed student single sign-on (SSO) portals. “In the campaigns we analyzed, students were targeted via personalized emails that contained TinyURL links,” Infoblox says.
Read Post
knowbe4

Notorious Cybercrime Group is Now Targeting Zendesk Users

Dec 8, 2025 By KnowBe4 Team In KnowBe4
ReliaQuest warns that the cybercriminal collective “Scattered Lapsus$ Hunters” appears to be using social engineering attacks to target organizations’ Zendesk instances. This group was behind a widespread campaign earlier this year that used voice phishing attacks to compromise dozens of companies’ Salesforce portals.
Read Post
knowbe4

KnowBe4 Earns Multiple 2026 Buyer's Choice Awards from TrustRadius

Dec 5, 2025 By KnowBe4 Team In KnowBe4
KnowBe4 is proud to announce that three of its leading security products — Security Awareness Training, PhishER/PhishER Plus and Compliance Plus — have been recognized as 2026 Buyer's Choice award winners by TrustRadius, a HG Insights company and buyer intelligence platform for business technology.
Read Post
knowbe4

Malicious AI Tools Assist in Phishing and Ransomware Attacks

Dec 5, 2025 By KnowBe4 Team In KnowBe4
Researchers at Palo Alto Networks’ Unit 42 are tracking two new malicious AI tools, WormGPT 4 and KawaiiGPT, that allow threat actors to craft phishing lures and generate ransomware code. These tools are criminal alternatives to mainstream AI tools like ChatGPT, with no safety guardrails to prevent users from using them for malicious activities. The latest version of WormGPT offers lifetime access for $220, or a monthly fee of $50.
Read Post
knowbe4

Report: Sophisticated Fraud Attacks Are on the Rise

Dec 4, 2025 By KnowBe4 Team In KnowBe4
Sophisticated online fraud techniques are growing more accessible to unskilled attackers, driven by AI tools and fraud-as-a-service platforms, according to Sumsub’s latest Identity Fraud Report. “hile the volume of attacks remains staggering, the nature of fraud is shifting,” the researchers write.
Read Post
knowbe4

The Ghost in the Machine: How a Multi-Stage Phishing Campaign Evades Security to Steal Microsoft 365 Credentials

Dec 4, 2025 By KnowBe4 Threat Lab In KnowBe4
Since November 3, 2025, KnowBe4 Threat Labs has been monitoring a highly sophisticated, multi-stage phishing operation that is actively targeting organizations to steal employees’ Microsoft 365 credentials. The campaign has been engineered to bypass traditional email security defenses, such as secure email gateways (SEGs), and multi-factor authentication (MFA) tools.
Read Post

2026 Phishing Threat Trends Report Preview

Dec 3, 2025 By KnowBe4 | Human Risk Management In KnowBe4
Ever wondered who answers when you call a cybercriminal? What happens in the aftermath of a Scattered Spider breach? Or why cybercriminals use legitimate platforms to send phishing emails? If so, this is the session for you. Join Jack Chapman, KnowBe4’s SVP of Threat Intelligence, as he pulls back the curtain on these topics. Jack will give you a first look at our latest Phishing Threat Trends Report, walking through attack scenarios and sharing the trends that are shaping the threat landscape.
View Video
knowbe4

KnowBe4 Is a Leader In the Gartner Magic Quadrant for Email Security For the Second Consecutive Year

Dec 3, 2025 By Bex Bailey In KnowBe4
Following its launch in 2024, Gartner has now published the second Magic Quadrant for Email Security —and KnowBe4 is delighted to once again be named a Leader! Email security is critical for all organizations globally. Fueled by factors such as GenAI and crime-as-a-service toolkits, the phishing threat landscape continues to become more sophisticated at an alarming pace.
Read Post
knowbe4

New Criminal Toolkit Abuses Browser Push Notifications

Dec 3, 2025 By KnowBe4 Team In KnowBe4
A new criminal platform called “Matrix Push C2” is using browser notifications to launch social engineering attacks, according to researchers at BlackFog. “This browser-native, fileless framework leverages push notifications, fake alerts, and link redirects to target victims across operating systems,” the researchers write.
Read Post
knowbe4

Scammers Are Exploiting the Holiday Shopping Season

Dec 1, 2025 By KnowBe4 Team In KnowBe4
Users should be particularly wary of holiday-themed scams over the next few weeks, according to researchers at Malwarebytes. “Mobile-first shopping has become second nature, and during the holidays, it’s faster and more frantic than ever,” Malwarebytes says. “Fifty-five percent of people get a scam text message weekly, while 27% are targeted daily. Downloading new apps, checking delivery updates, or tapping limited-time offers all feel routine.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.