Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

knowbe4

Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters

Oct 23, 2026 By KnowBe4 Team In KnowBe4
Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.
Read Post
knowbe4

Warning: Calendly Phishing Pages Are Targeting Job Seekers

Oct 22, 2026 By KnowBe4 Team In KnowBe4
Researchers at Malwarebytes warn that a phishing campaign is using spoofed Calendly pages to trick users into handing over their Facebook and Google account credentials. The phishing sites pose as Calendly booking pages for job interviews at Meta, asking users to enter their information to sign up for a phone call with a recruiter. After this, the user is taken to a spoofed Facebook or Google login page designed to steal their credentials and intercept their multifactor authentication codes.
Read Post
knowbe4

Job Seekers Who Use AI for Applications Need to be on the Lookout for Scams

Oct 22, 2026 By KnowBe4 Team In KnowBe4
Researchers at Malwarebytes warn that job seekers are increasingly vulnerable to scams as AI enables them to take a “spray-and-pray” approach to job applications. Users who have automated their job application process are more likely to forget where they’ve applied, and an unsolicited message from a recruiter may seem more plausible. Job seekers can also be more willing to overlook or ignore red flags associated with scams, since they’re anxious to avoid missing an opportunity.
Read Post

The Data Center Episode: Power, Water & Local Impact | Attempted Intelligence Ep. 2

Oct 21, 2026 By KnowBe4 | Securing Humans & Agents In KnowBe4
How much power and water do AI data centers actually consume—and what does their growth mean for local communities? In Episode 2 of Attempted Intelligence, hosts Harlan Parrott (VP of AI Innovation at KnowBe4) and Matt Duren (SVP of Engineering for AI & Data) go head-to-head in a friendly debate over the environmental and economic realities of AI infrastructure. A coin flip assigns their positions as they tackle the viral claims surrounding AI energy consumption, local water usage, and the trade-offs facing local governments.
View Video
knowbe4

AI Data Centers: Environmental Disaster or Groundbreaking Innovation?

Oct 21, 2026 By KnowBe4 Team In KnowBe4
Insights from Attempted Intelligence, Episode 2, hosted by Matt Duren, SVP of AI and data, KnowBe4 and Harlan Parrott, VP of AI innovation, KnowBe4. AI data centers are one of the most debated topics in the world right now. Some people worry about the energy and water it takes to run them. Others see the foundation for the next wave of AI advances. Both camps have a point. On episode two of the Attempted Intelligence podcast, Matt and Harlan each picked a side and debated it.
Read Post
knowbe4

Warning: Phishing Attacks Are Abusing RMM Tools to Target Bank Accounts

Oct 21, 2026 By KnowBe4 Team In KnowBe4
Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools. “Hybrid phishing-to-RMM campaigns have emerged as a potent method to target North American financial institutions, with a focused interest in business commercial banking accounts,” Fortra says.
Read Post
knowbe4

Free Helpline for Victims of Online Crime Pilots in South Africa

Oct 20, 2026 By KnowBe4 Team In KnowBe4
South Africans who fall victim to cybercrime now have more support available. MiDO Academy, The Cyber Helpline (UK) and Amazon Web Services (AWS) launched the pilot of The Cyber Helpline in South Africa, a free, confidential service providing practical guidance and compassionate support to individuals affected by online fraud, investment and employment scams, hacked accounts, phishing and smishing, social media fake profiles, sextortion, online harassment, identity theft, malware and ransomware incidents.
Read Post
knowbe4

[Cybersecurity Awareness Month] 100 Passwords, One Brain: Stop Asking Humans to Behave Like Machines

Oct 19, 2026 By Anna Collard In KnowBe4
I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession. For years, our industry's response to this has been some version of finger-wagging. Use unique passwords, make them longer, add a symbol and change them every 90 days. Do not write them down.
Read Post
knowbe4

Phishing Is Now A Criminal Impersonation Industry. Here Is How To Fight Back

Oct 17, 2026 By Stu Sjouwerman In KnowBe4
For years, we described phishing as an email problem: an attacker writes a convincing message, sends it to thousands of people and waits for someone to click. That model is now outdated. Microsoft’s disruption of YAM Store, CoGUI and Iron Man exposed something much larger: a cloud-based impersonation industry.
Read Post
knowbe4

Phishing Attacks Target YouTubers With Phony Sponsorships

Oct 16, 2026 By KnowBe4 Team In KnowBe4
A phishing campaign is targeting YouTubers with phony sponsorship offers, according to researchers at ESET. The emails are personalized to each target, making specific references to their channels, and are designed to trick users into granting access to their Google accounts. “One such recent campaign impersonates Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment,” ESET says.
Read Post
knowbe4

NIS2 Part Two: How Stolen Vendor Data Fuels Downstream Attacks

Oct 16, 2026 By Martin Kraemer In KnowBe4
In part one of this NIS2 series, we examined why vendor questionnaires fall short and how third-party breaches impact downstream organizations across Europe. But what happens after a supplier containment phase ends? The long-term danger lies in how attackers leverage exfiltrated supplier data to launch hyper-targeted social engineering attacks against an organization’s employees. A supply chain incident does not end when a service provider detects, contains, or recovers from an attack.
Read Post
knowbe4

Report: 9 out of 10 Americans Have Been Targeted by Scams

Oct 15, 2026 By KnowBe4 Team In KnowBe4
91% of Americans have been targeted by a scam, and 17% have fallen victim to one, according to a new survey by Consumer Reports. Notably, 20% of respondents said the latest scam they encountered was personalized, indicating that attackers are increasingly using automation and public or leaked information to craft targeted phishing attacks.
Read Post
knowbe4

Crime or Career? What Young People Told Us About Cybercrime Recruitment

Oct 15, 2026 By Anna Collard In KnowBe4
The above was a quote from a young South African responder to our survey on cybercrime perceptions. Notice what's missing: there is no villain, underground or dark web. Just a skill, a community and a sense of finally being good at something. That is the picture that emerges from Crime or Career? Youth voices on cybercrime across the Global South, our new report developed in cooperation with the Global South Cyber Academies Network (CAN).
Read Post
knowbe4

NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short

Oct 14, 2026 By Martin Kraemer In KnowBe4
Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers. Article 21(3) further specifies that an organization must take each supplier’s specific vulnerabilities into account.
Read Post
knowbe4

Warning: Phishing Attacks Are Using AI-Themed Ad Lures

Oct 14, 2026 By KnowBe4 Team In KnowBe4
A phishing campaign is using AI-themed lures to target employees who operate advertising accounts, according to a new report from Island. The campaign is launched from a phishing platform that poses as a portfolio of AI advertising tools, using branding from Gemini, Claude, ChatGPT, Perplexity, and Muse. The platform’s operator added a fake Muse Ads lure eight days after Meta launched its Muse AI agent.
Read Post
knowbe4

Report: Ransomware Attacks Involving Data Theft Are Surging

Oct 13, 2026 By KnowBe4 Team In KnowBe4
Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.
Read Post
knowbe4

Extortion Groups are Impersonating Help Desks to Gain Initial Access

Oct 13, 2026 By KnowBe4 Team In KnowBe4
Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters. “Attackers overwhelmingly targeted users and their unmanaged devices to gain access to accounts,” the researchers write.
Read Post
knowbe4

[Cybersecurity Awareness Month] Trust, but Verify: Navigating the Era of AI Deepfakes

Oct 12, 2026 By Dr. Kawin Boonyapredee In KnowBe4
The digital landscape faces a new and complex challenge: the rise of generative AI. While these tools offer incredible potential for innovation, they also provide malicious actors with sophisticated ways to deceive even the most vigilant users.
Read Post
knowbe4

The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust

Oct 9, 2026 By KnowBe4 Threat Lab In KnowBe4
A legitimate sender does not mean legitimate content. Attackers have abused legitimate services such as DocuSign, SharePoint, Adobe Sign, Dropbox and Google Drive to exploit that trust for years. KnowBe4's Phishing Threat Trends Report Vol. 7, released April 2026, flagged this shift at the industry level: 22% of all phishing attacks are now sent through a legitimate platform, with attackers moving from impersonating a brand to abusing that brand's actual infrastructure.
Read Post
knowbe4

Two Systems, One Truth: Unifying Training Records Across SAT and LMS

Oct 8, 2026 By Nick Gasse In KnowBe4
Somewhere in your security and compliance stack, there are records that prove your employees completed their security awareness training. But when these records need to serve as evidence, would they actually hold up to scrutiny? For many companies, the answer is no, and that’s becoming a major risk. Following steadily rising claims over the years, insurers have narrowed their coverage definitions and requiring stricter adherence to security standards.
Read Post
knowbe4

Warning: Attackers Are Tricking Employees Into Sharing Malicious Calendar Invites

Oct 7, 2026 By KnowBe4 Team In KnowBe4
Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally. The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact. The attack takes place as follows.
Read Post
knowbe4

Remove the Language Barrier from Your Training Program's Global Rollout

Oct 6, 2026 By Nick Gasse In KnowBe4
At any given moment, there’s an employee somewhere in the world tuning out of a phishing training module that was translated from another language. Every word is rendered correctly, yet the learner still stops paying attention. In these situations, the translation often gets the blame for not engaging the learner, but the real culprit is design.
Read Post
knowbe4

The Price of a Deal: How Scammers are Hijacking Amazon Prime Day

Oct 6, 2026 By KnowBe4 Threat Lab In KnowBe4
As millions of shoppers prepare their wishlists and await discounts for Amazon’s Prime Big Deal Days starting October 6, cybercriminals are gearing up for their own payday. In the weeks leading up to major shopping events, Amazon impersonation campaigns reach an annual peak.
Read Post
knowbe4

Warning: Tech Support Scams Are Abusing Google Ads

Oct 6, 2026 By KnowBe4 Team In KnowBe4
Researchers at Netskope are tracking a phishing kit that hijacks users’ browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.
Read Post
knowbe4

[Cybersecurity Awareness Month] Cyber Espionage: When the Attacker's Best Asset Is You

Oct 5, 2026 By Erich Kron In KnowBe4
Spies have always relied on technology, disguises, secret communications and clever gadgets, at least if the movies are to be believed. But some of the most effective tools in the espionage business have always been people. Convince the right person to open a door, reveal a secret or trust someone they should not, and suddenly bypassing the sophisticated security system becomes unnecessary.
Read Post
knowbe4

Threat Actors Abuse Trusted Accounts and Internal Tools to Launch Convincing BEC Attacks

Oct 5, 2026 By KnowBe4 Team In KnowBe4
Attackers are continually finding new ways to refine business email compromise (BEC) attacks, according to Douglas McKee, Director of Vulnerability Intelligence at Rapid7. When attackers compromise trusted tools and accounts, they can manipulate victims’ view of reality. One way attackers can achieve this is through what McKee calls “calendar warfare,” in which attackers use calendar meetings to trick users into falling for attacks.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.