All You Need Is One – A ClickOnce Love Story

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Describes embedding a Base64 Meterpreter payload in an Office VBA macro so a legitimate emailed document can be re-sent as a backdoor after harvesting domain credentials.

Testers hid phishing codes in fortune cookies promising a $50 gift card, luring staff to a promo site that proxied the corporate login via Evilginx — physical media sidesteps email training.

Discover the cascading risks of malicious Connected Apps in Salesforce. Learn how to assess business impact, secure your org, and protect critical infrastructure.

Real social engineering engagement stories: an open SMTP relay let testers phish from the company's own domain, plus vishing lessons and practical tips to strengthen organizational defenses.

Social engineering remains the top way attackers gain entry. This article lists ten questions spanning phishing, vishing, and physical pentesting that help organizations get more from their testing.