France built Tchap as the secure alternative to WhatsApp for 825.000 civil servants. Mandatory since September 2025, sovereign infrastructure, end-to-end encryption on private messages. On June 7, ANSSI detected a breach. The entry point was not a zero-day. It was one public servant account, social-engineered into yielding access.
Banks are warning employees about spear phishing again. The checklists are familiar: verify the sender, use a second channel, follow approval processes. Good hygiene. But the warning itself encodes an assumption that is quietly wrong, that the threat is still mostly about email, and mostly about obvious manipulation. It is not.
Man-in-the-middle didn’t die. It changed altitude. EvilGinx2, Tycoon 2FA, Rockstar 2FA are MITM proxies wearing a phishing kit costume, and 80% of what they capture is corporate. Full breakdown, defensive code, and the angle awareness training keeps missing.
DragonForce spent two weeks inside a major US services firm, routing command-and-control traffic through Microsoft Teams relay servers. No alert fired. The monitoring stack saw legitimate Microsoft infrastructure and moved on. This is what happens when attackers stop breaking things and start borrowing them instead.
138 campaigns in one week, and one of them cloned a university login portal with a kit the same operator already ran against other atenei. The attacker industrialized phishing for free. Here’s the angle nobody’s pricing in, plus three defensive tools you can run today.
Six .xyz domains. Two phone numbers. Zero malicious links. Malwarebytes caught a fake-invoice TOAD campaign still wearing its #TFN# merge fields. The defenders’ nightmare isn’t the scam, it’s the assembly line behind it.
Everyone ran the same headline: hackers asked Meta’s AI nicely and it handed over high-profile Instagram accounts. I went through it line by line. The mechanism is mislabeled, the victim profile contradicts the panic, and two completely different attacks got welded into one story.
A free malware-as-a-service platform built and traded by teenagers has infected over 116,000 machines through Minecraft mods, with a suggestions page where users vote on adding ransomware. The reflex is to blame the kids. The harder observation is that we mistook a generation’s fluency with technology for judgment about it, and the people who actually hold that judgment are retiring.
Swisscom blocks 1,500 phishing campaigns a month and bought sponsored news space to say so. Translation: their filter moat is eroding, the regulator is watching, and the defensive line just moved to the human layer. A Packet Hunters breakdown of the marketing tell, and the technical reasons behind it.
31.000 incidents, 22.000 confirmed breaches. Everyone is talking about vulnerability exploitation overtaking credential theft. The number that should keep CISOs awake is somewhere else – and Verizon’s own breach history quietly confirms it.
