email

How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.

Before launching a phishing attack, attackers initiate correspondence with the victim.

Cybercriminals have started leveraging Google’s legitimate AppSheet service to roll out phishing campaigns that target users’ personal data and credentials. Here’s a look at how this is even possible, and what you need to do to secure your accounts.

Phishers using ASCII art to mask QR-codes.

Attackers are delivering phishing links via Google Tasks notifications.

We’re diving into the most intriguing and sophisticated phishing and spam schemes intercepted by our experts throughout 2025.

Crooks are impersonating your brand to attack customers, partners, and employees. How do you spot — and stop — an attack of the clones?

GReAT experts have analyzed a new targeted campaign by the ForumTroll APT group.

Here’s how to mitigate the risks of targeted attacks on your organization’s mail servers.

You’ve received a threatening email. What’s your next move?

Attackers pretending to be airlines or airports are sending out fake partnership offers.

Attackers spin poignant tales of lost private keys as they try to phish seed phrases.

Don’t panic. Again, don’t panic. Did we say don’t panic? A common threat explained in simple terms.

Scammers are tricking people into giving up cryptocurrency through Google Forms surveys. Here is what they are doing and how to avoid falling victim to this scam.

A curious case of spear-phishing email techniques employed on a mass scale.

Scammers are exploiting Google services to send fake law enforcement inquiry notifications, making them look like they originate from accounts.google.com.

Archives are being used in targeted phishing and other attacks on organizations. What tools, settings, and policies can mitigate the threat?

We’ve added technology that checks QR codes in emails for phishing links.

How to avoid giving away your password to scammers when logging in to third-party sites or viewing “encrypted” or “confidential” documents.

The patch that fixes CVE-2024-49040 in Microsoft Exchange is temporarily unavailable. We’ve implemented heuristics that detect attempts to exploit it.

This phishing campaign incorporates ghost spoofing, embedded text in images, a PDF file, a QR code, DocuSign imitation, and Cloudflare verification — yet it still completely misses the mark.