phishing - AlphaHunt Converge

weekly

[SIGNALS WEEKLY] Exploited Edge, Social Engineering, and Subtle Evasion

A Teams message from “IT” can now be the first step in a domain takeover: remote-support session, silent install, then AD and WinRM movement.

gametheory

[GAME THEORY] The help desk is becoming the new intrusion broker.

Vishing works because urgency can become SaaS authority. Break the trust transaction without breaking support.

gametheory

[GAME THEORY] The Phish Did Not Steal the Password. It Rented the Protocol.

Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

weekly

[SIGNALS WEEKLY] Tokens, Edges, and Exploits: Shifting Paths to Compromise

The token survived. npm packages, CI/CD runners, and edge boxes keep turning “contained” into “still owned.” The boring weakness became the breach path.

gametheory

[GAME THEORY] ShinyHunters- Names Fade. Playbooks Stick.

The ShinyHunters problem isn’t the name. It’s the chain: MFA reset, weird login, OAuth grant, SaaS export, extortion later.

forecasts

[FORECAST] Beyond PLCs: Are Iran-Linked Operators More Likely to Chase New Targets, New Tooling, or New Impact? UPDATED 2026-04-08!

Everyone saw the PLC headline and immediately built their whole Iran take around exposed controllers. Cool. The nastier question is what happens when the next move comes through identity, admin planes, or some target class nobody staffed for.

fraud

The Real Government Fraud Story- Identity Infrastructure

“Fraud” makes it sound random. It isn’t. It’s identity infrastructure with a cash-out layer. Same proofing gaps, same rails, same reusable parts. People keep chasing claims instead of the production line.

weekly

SIGNALS WEEKLY: When Trust Breaks- Pipelines, PLM, and Phishing at Scale

Everyone loves “shift left” until the thing in the pipeline shifts your secrets somewhere else. Security tooling has officially joined the attack surface like it was invited.

forecasts

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs - UPDATED: 2026-03-26

Iran cyber risk is not about whether they’ll be active. They will. The real question is whether the next 8 weeks produce a publicly attributed, materially disruptive hit with a new twist beyond the usual password-spray sludge. Tenant sabotage is the part to watch. 👀🔥

forecasts

[FORECASTS] From Password Sprays to Tenant Sabotage: The 8-Week Iran Cyber Risk for U.S. and Israeli Orgs

Iran cyber risk isn’t just “watch for wipers.” It’s the same ugly identity-first playbook: password sprays, MFA abuse, cloud access… then maybe admin-plane sabotage. Recent reporting says activity is already reaching U.S. targets. Cute.

weekly

SIGNALS WEEKLY: Cisco Catalyst SD-WAN Exploitation + OAuth Redirect Abuse + Prompt Injection Observed in the Wild

Edge + identity + AI = the new “oops.” 😬🧨🤖 ED 26-03 on Cisco Catalyst SD-WAN exploitation, OAuth redirect abuse that lands users in malware without token theft, plus Gemini panel hijack vs indirect prompt injection in the wild.

forecasts

[FORECAST] ShinyHunters SaaS Data Theft: Why Non-Ransom Monetization Looks Increasingly Attractive

Our new forecast asks: will ShinyHunters make more in 2H 2026 by selling SaaS access/data than by getting paid? Signals say yes. 🕵️‍♂️💸☁️