PacketHunters delivers technical cybersecurity threat analysis, offering deep dives into attacks, indicators, tactics, and methods behind real-world security incidents.
Passkeys resist phishing, but enrolling a new credential is a separate security decision. Claudia examines vishing and passkey registration abuse, with Entra controls, a KQL audit query and a practical test for verifying support requests.
One distracted click, one expiring credit card, one Ticketmaster charge for £500. Inside the Spotify phishing kit that’s currently eating subscribers alive – and the brand-impersonation playbook behind it.
No fake login page. No stolen password. No MFA prompt to fail. EvilTokens walks the victim through Microsoft’s own sign-in flow, and the phishing page stays encrypted until the browser renders it. Here is the full attack chain and the hunting queries your SOC needs today.
Two guys phoned a phone shop, said they were support, and walked out with 365,000 customer records – 41,359 with payment data attached. The Garante fined Wind Tre €1,715,600.
60.000 chats. 24 hours. DPO disabled. Italy laughed at a chatbot that recommends Pepsi for organic food. The part nobody is laughing about is what ‘alignment disabled’ means when a small, cheap, on-prem model lands in the wrong hands. A technical breakdown of provenance, scope, and how to smell-test the fuffa.
Man-in-the-middle didn’t die. It changed altitude. EvilGinx2, Tycoon 2FA, Rockstar 2FA are MITM proxies wearing a phishing kit costume, and 80% of what they capture is corporate. Full breakdown, defensive code, and the angle awareness training keeps missing.
138 campaigns in one week, and one of them cloned a university login portal with a kit the same operator already ran against other atenei. The attacker industrialized phishing for free. Here’s the angle nobody’s pricing in, plus three defensive tools you can run today.
Six .xyz domains. Two phone numbers. Zero malicious links. Malwarebytes caught a fake-invoice TOAD campaign still wearing its #TFN# merge fields. The defenders’ nightmare isn’t the scam, it’s the assembly line behind it.
Everyone ran the same headline: hackers asked Meta’s AI nicely and it handed over high-profile Instagram accounts. I went through it line by line. The mechanism is mislabeled, the victim profile contradicts the panic, and two completely different attacks got welded into one story.
Swisscom blocks 1,500 phishing campaigns a month and bought sponsored news space to say so. Translation: their filter moat is eroding, the regulator is watching, and the defensive line just moved to the human layer. A Packet Hunters breakdown of the marketing tell, and the technical reasons behind it.
