A newly published academic paper introduces a new hacker tool called PixSnapping (download PDF), an advanced attack that can steal screen pixels from Android devices and reconstruct sensitive data like 2FA codes in real time. The research demonstrates that an attacker-controlled app can capture or infer the digits displayed by authenticator apps such as Google Authenticator in under thirty seconds.

A study from UC San Diego Health ran nearly 20,000 employees through ten simulated phishing campaigns over eight months. Training made almost no difference. Employees who had recently completed mandatory cyber awareness courses failed phishing tests at virtually the same rate as those who had not. The measured improvement was just 1.7%. More than 75% of employees spent less than a minute on the training material. Millions are spent on annual training. The phishing success rate stays the same. The lesson is clear. Training alone does not protect enterprises from phishing.

Microsoft Active Directory Federation Services is one of the most widely deployed authentication systems in enterprise IT. Organisations use it to provide single sign-on across internal and external applications, often as a bridge between on-premises Active Directory and cloud services. It is also structurally vulnerable to a class of attack that legacy MFA cannot stop.

Phishing attacks no longer rely on obvious tells. Misspelled words, generic greetings, and suspicious domains are yesterday’s problem. Today, the most effective phishing campaigns use Unicode characters that look identical to the characters they replace. The fake URL looks real. The fake site looks real. There is nothing for the human eye or most security tools to catch. The deception happens at a level most people never inspect.

CSO Online just dropped a staggering stat: ransomware attacks have jumped 179% in the first half of 2025. Credential theft? Up 800%. That’s not a typo. Eight. Hundred. Percent.

CISA just dropped a bombshell. In its latest alert (dated July 25, 2025), the U.S. Cybersecurity and Infrastructure Security Agency is now urging every enterprise to implement phishing-resistant multifactor authentication (MFA)—everywhere: for email, VPNs, and anything touching critical systems. Not “consider it.” Not “evaluate in the future.” Require it. Now.

Social engineering attacks don’t exploit software. They exploit people. An attacker who can convince a help desk agent to reset a password, or persuade an employee to approve an MFA request, bypasses every technical control in place. No vulnerability was needed. No malware was deployed. The breach happened because someone was convinced. This guide covers the most common social engineering techniques targeting enterprise authentication, how each one works in practice and why the solution is not better training.

Cybersecurity Dive just reported that Clorox is suing Cognizant for $380 million after a cyberattack crippled operations. The alleged trigger? A hacker posed as an employee and convinced someone to hand over a password. That’s it. No advanced zero-day exploit. No AI-powered quantum hack. Just a social engineering phone call and a password—and now Clorox wants $380 million in damages.

Attackers are no longer trying to break in. They are logging in. Identity-based attacks have replaced network intrusions as the dominant breach method. Firewalls, antivirus and perimeter defences are largely irrelevant when an attacker already holds valid credentials. Understanding what these attacks look like and how they work is the starting point for building authentication that can actually stop them.

Microsoft’s recent advisory on Octo Tempest should make every CISO lose sleep. This group isn’t just hacking software vulnerabilities. They’re hacking people, impersonating employees, tricking help desks into resetting passwords, stealing session cookies, and bypassing legacy MFA with social engineering.

Generative AI just made phishing so easy that anyone can do it—and do it convincingly. According to Axios, researchers demonstrated that in just 30 seconds, a simple natural-language prompt was all it took to build a pixel-perfect spoofed login site. No coding. No technical skills. Just type “build a copy of the website login.okta.com,” and a convincing clone appears, ready to trick anyone into handing over credentials.

Attackers are not breaking in. They are logging in. Stolen credentials are now the most reliable entry point for enterprise breaches. Most defenses are built to stop an attacker trying to force their way through. The attacker who already has a valid username and password walks straight past them.