Twilio and Cloudflare under phishing pressure in 2022
Similar text messages led to different outcomes. The useful part of the comparison begins after the passwords were entered.
/var/log/thoughts
Articles
Structured notes on security, engineering, and systems thinking.
Passwords, sessions and AiTM phishing
Authentication can complete normally while an intermediary captures the session created immediately afterwards.
Device-code phishing
The sign-in happens on the real domain, but the resulting tokens can still be issued to a device controlled by the attacker.
Measuring a defence beyond the click
A click rate does not show whether access succeeded, whether anyone reported the attempt, or how long containment took.