Threats
A running catalog of phishing and brand-impersonation techniques attacking the open internet. How each works, when we first saw it, and whether attackers are still using it today.
A ClickFix-family lure dressed as a Cloudflare 'I am not a robot' challenge. JavaScript silently writes a PowerShell command to the clipboard while the page tells the user to open Windows Terminal as admin, paste, and press Enter. The pasted command fetches and executes an attacker-controlled binary.
Full write-upAttackers buy paid search ads on brand keywords, then route the click to a lookalike domain hosting a phishing page. Because the ad sits above the organic results, it intercepts traffic before users ever see the legitimate site.
Full write-up