Phishing

Gambling 6 min read

Account Takeover in Online Casinos

How online casinos detect account takeover: credential stuffing, deposit fraud signals, and the response steps that stop withdrawals before they clear.

Gaming 8 min read

Bonus Abuse in iGaming: Detecting Coordinated Rings

Coordinated bonus abuse rings exploit iGaming promotions through shared infrastructure and scripted behavior. Learn how fraud teams detect and stop them.

Gaming 10 min read

Affiliate Fraud in iGaming: Detection and Prevention Guide

Affiliate fraud in iGaming takes three forms: domain typosquatting, brand bidding, and fake traffic. Detection signals and enforcement options for each.

Research 4 min read

The Hotel Wi-Fi Trap: How Russian Spies are Weaponizing Captive Portals (And Why You Should Stick to 5G)

APT29's CaptiveCrunch campaign hijacks hotel Wi-Fi captive portals to deliver the CornFlake RAT and steal MFA-protected credentials. Here's how it works and the one fix that actually stops it.

Research 4 min read

AliExpress Is Using Silent WebAudio to Fingerprint Your Browser

A Bluetooth glitch led to an unexpected discovery: AliExpress runs silent WebAudio processing as part of a browser fingerprinting anti-fraud system. Here's what was found and what it means for security and privacy.

Research 3 min read

Fake Paws, Real Scams: How to Spot and Avoid Online Puppy Scams

Online puppy scams use stolen photos, fake breeders, and endless "fees" to steal your money and break your heart. Here's exactly how the trap is set and the one rule that protects you.

Research 4 min read

UAC-0099 Weaponizes Notepad++ and WinRAR Plugins to Deliver Malware

UAC-0099 is hijacking trusted apps like Notepad++ and WinRAR through malicious plugins and DLL sideloading. Here's the full infection chain, based on CERT-UA's technical advisory.

Blog

More phishing posts

Research 5 min read

From Exploit to Phishing: How Attackers Weaponized the Coldcard Entropy Incident

Days after the Coldcard entropy vulnerability went public, a phishing campaign impersonating Coinkite began tricking users into installing remote access malware disguised as a hardware audit tool.

Crypto 4 min read

How Impersonation Fuels Gift Card and Crypto Scams

Gift card and crypto scams work because attackers borrow someone else's identity: a celebrity, an investment manager, even a loved one's voice. Here's how the impersonation angle actually plays out.

Research 2 min read

How a Real ChatGPT Link Delivers Phishing via a Fake Codex Install

A malicious Google Ad leads to a real chatgpt.com link, where a fake "Codex" install command hides a base64 payload that drops the MacSync infostealer. Here's the full chain.

Research 3 min read

Fake Data Breach Claims: Why Scam-Style Extortion Is Surging in 2026

Scam-style extortion is rising: attackers post fake data breach claims on leak sites with no real intrusion. Here's how the bluff works and how to verify before you panic.

Research 3 min read

Click to Pray Exposes 700k Users: Inside a Textbook IDOR Failure

The Vatican's Click to Pray app leaked the personal data of 700,000 users for over six months through a basic IDOR flaw. Here's how sequential user IDs and zero auth checks did the damage.

Research 6 min read

A Hard Lesson in Randomness: Understanding the Coldcard Entropy Incident

A firmware bug silently weakened seed generation on Coldcard hardware wallets, letting an attacker recreate and drain vulnerable wallets at scale. Here's how the entropy failure worked.

Phishing

Sign up for our newsletter

More phishing posts

Join our newsletter