RedACT counted 148 confirmed ransomware claims against Italian organizations in six months. Almost none of them required sophistication to pull off. What they required was a set of human behaviors so consistent (before the breach and especially after it) that thirty different gangs can price them into a business model.
A Montrachet at an impossible price lands in the inbox of someone who has spent years posting about white Burgundy. Wine phishing scams are not spray and pray. They are built from leaked customer data and public passion, and the wine trade taught attackers everything they know about scarcity and urgency.
One distracted click, one expiring credit card, one Ticketmaster charge for £500. Inside the Spotify phishing kit that’s currently eating subscribers alive – and the brand-impersonation playbook behind it.
No fake login page. No stolen password. No MFA prompt to fail. EvilTokens walks the victim through Microsoft’s own sign-in flow, and the phishing page stays encrypted until the browser renders it. Here is the full attack chain and the hunting queries your SOC needs today.
The WhatsApp-versus-Signal-versus-Telegram debate assumes scammers pick a side. They don’t. This Decoded walks through why the app is never the perimeter, why Telegram’s default isn’t what people think it is, and what actually stops the con.
The 2026 SANS survey lands on a reassuring finding: a trained, skeptical human is still the best defense against AI-enabled attacks. Sit with the rest of the numbers and a harder pattern shows up. Skepticism runs on time and discomfort, and an AI-shaped attack is built to remove both, on both sides of the firewall.
Two guys phoned a phone shop, said they were support, and walked out with 365,000 customer records – 41,359 with payment data attached. The Garante fined Wind Tre €1,715,600.
Excerpt: For two days in July, any Instagram user could pull another person’s public posts into an AI-generated image by @-mentioning them, with the setting enabled for everyone by default. Meta withdrew the option after backlash. The interface disappeared. The assumption underneath it, that a person’s public content is reputation exposure rather than attack material, did not.
Phishing is the single most common way into a breached company right now, and it has never been cheaper to run against you. So how did breached organizations respond? By cutting their planned security spend. Same cost-cutting instinct on both sides of the table, opposite blast radius, and only one side collects.
60.000 chats. 24 hours. DPO disabled. Italy laughed at a chatbot that recommends Pepsi for organic food. The part nobody is laughing about is what ‘alignment disabled’ means when a small, cheap, on-prem model lands in the wrong hands. A technical breakdown of provenance, scope, and how to smell-test the fuffa.
