The login page is real. The device you are authorizing might not be yours
Device-code phishing exposes a limit of the advice to check the domain: a genuine sign-in can still authorize a session initiated by someone else.
7 min read
The archive
All stories
Sourced guides, explanations and news analysis. Read by question, not by jargon.
A CAPTCHA should not need your terminal: the boundary ClickFix tries to erase
The trick is not a mysterious button. It is a change of task: a website turns a familiar verification step into permission to run software on your device.
8 min read
A passkey-themed lure is not the same as a broken passkey
A September Microsoft report illustrates why the name of a security feature cannot substitute for understanding the action a message asks you to approve.
4 min read
EvilTokens puts the relationship inside the inbox at the center of the story
Microsoft's September 22 report describes more than polished phishing messages. Our analysis asks what changes when compromised correspondence reveals how an organization makes decisions.
4 min read
The first response to a security report can decide whether there is a second one
A reporting culture is built in ordinary replies, not awareness posters. Make it possible to say what happened before someone knows how serious it is.
6 min read
A familiar voice is a clue, not a verification method
When a call sounds like someone you know, the safest question is not whether you can hear an AI artifact. It is how to check the request outside that call.
6 min read
Phishing-resistant MFA protects a sign-in. It does not approve the story around it.
Passkeys and security keys are valuable controls. Understanding their scope helps explain why account recovery, consent and payment decisions still matter.
6 min read
The help desk is not the weak link. The reset process is the boundary.
Account recovery asks support staff to restore trust precisely when a normal proof is missing. That decision needs a designed process, not a test of confidence.
6 min read
Urgency does more than rush you. It removes the second opinion.
A deadline becomes dangerous when it is used to replace verification, isolate a decision or excuse a change in process.
6 min read
Pretexting: the story that makes an unusual request feel ordinary
Social engineering often succeeds before the dangerous request arrives. A plausible role and a familiar process can do much of the work.
6 min read