Phishing with Misfortune Cookies

Warns of social engineering as employees return to offices—fake return-to-office emails, help-desk MFA enrollment tricks—citing Verizon DBIR's finding that 85% of breaches involve a human element.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

ClickOnce deployment, built for easy Windows app installs, doubles as a phishing vector: one click can grant a malicious payload temporary admin privileges, controlled by registry trust settings.

Describes embedding a Base64 Meterpreter payload in an Office VBA macro so a legitimate emailed document can be re-sent as a backdoor after harvesting domain credentials.

Discover the cascading risks of malicious Connected Apps in Salesforce. Learn how to assess business impact, secure your org, and protect critical infrastructure.

Real social engineering engagement stories: an open SMTP relay let testers phish from the company's own domain, plus vishing lessons and practical tips to strengthen organizational defenses.