Six .xyz domains. Two phone numbers. Zero malicious links. Malwarebytes caught a fake-invoice TOAD campaign still wearing its #TFN# merge fields. The defenders’ nightmare isn’t the scam, it’s the assembly line behind it.
Everyone ran the same headline: hackers asked Meta’s AI nicely and it handed over high-profile Instagram accounts. I went through it line by line. The mechanism is mislabeled, the victim profile contradicts the panic, and two completely different attacks got welded into one story.
A free malware-as-a-service platform built and traded by teenagers has infected over 116,000 machines through Minecraft mods, with a suggestions page where users vote on adding ransomware. The reflex is to blame the kids. The harder observation is that we mistook a generation’s fluency with technology for judgment about it, and the people who actually hold that judgment are retiring.
Swisscom blocks 1,500 phishing campaigns a month and bought sponsored news space to say so. Translation: their filter moat is eroding, the regulator is watching, and the defensive line just moved to the human layer. A Packet Hunters breakdown of the marketing tell, and the technical reasons behind it.
31.000 incidents, 22.000 confirmed breaches. Everyone is talking about vulnerability exploitation overtaking credential theft. The number that should keep CISOs awake is somewhere else – and Verizon’s own breach history quietly confirms it.
NYC Health + Hospitals disclosed a months-long breach exposing biometric, medical, and financial data for 1.8 million people through a third-party vendor. Two-thirds of the dataset can be rotated. The rest cannot. The remediation playbook the industry inherited from the credit-card era does not bend to fit data that is permanent by nature.
At the Tuscany Lightning Summit 2026 in Viareggio, our CTO Francesco Baccaro stood in front of some of the most paranoid engineers in the Bitcoin ecosystem and told them their cryptography wasn’t the problem. The $1.46B Bybit heist, the rise of Permit and EIP-7702 phishing, and a hard truth the crypto industry keeps ignoring.
Two breaches. Eight months. Same group. ShinyHunters tore through Instructure again: 3.65 TB, 275 million records, 9,000 institutions. Device Code Flow plus a phone call. Passkeys don’t help. Here’s the playbook and the defenses.
[email protected] sent the phishing email. DKIM, SPF, DMARC all green. The attacker never spoofed anything — they got Robinhood to deliver the payload for them. Here is the chain, the code, and why your awareness training is now obsolete.
A €5 gadget. A postcard. 24 hours of real-time tracking on a €500 million NATO frigate. The trust model wasn’t hacked — it was never there. Full technical breakdown and defensive tools inside.
