CyberheistNews Vol 16 #29 | July 21st, 2026
ClickFix Social Engineering is Now the Leading Malware Delivery Method
The ClickFix social engineering technique is now the top malware delivery method, according to a new report from ReliaQuest. These attacks trick users into copying a malicious command, then pasting it into a terminal and running it on their computers.
"ClickFix remained the dominant delivery method this period and, for the first time, we observed it expand to macOS, delivering infostealers onto a platform many organizations still monitor less closely than Windows," the researchers write. "This means ClickFix can no longer be handled as a special case.
"Training, detection and triage for it should run continuously on both Windows and macOS." ReliaQuest notes that AI tools are enabling threat actors to scale social engineering attacks with very little added effort.
"Adversaries leaned on two strategies: social engineering at scale and attacks on unpatched, internet-facing infrastructure," the researchers write. "The leading technique 'ClickFix' drove the first, shifting delivery from compromised websites to emailed links, while 'Qilin,' the period's most active ransomware operator, continued exploiting unpatched edge devices for mass extortion.
"What's more, AI is making social engineering faster, cheaper and more convincing, accelerating familiar techniques rather than creating new ones." Organizations should ensure that their security awareness programs train employees to recognize ClickFix tactics.
[CONTINUED] Blog post with links:
https://blog.knowbe4.com/clickfix-social-engineering-top-malware-delivery-method
Custom Security Training in Minutes, Not Months
Building custom content used to mean big budgets and weeks of production time, but AI-driven threats don't wait. Your training shouldn't either.
Watch this demo to see how KnowBe4's AI agents deliver tailored content that meets your organization's exact needs, at speed. From generating custom training from your own policies to simulating deepfakes of your own executives, see what's now possible in minutes.
What you'll see in this demo:
- Content Creation Agent: Turn simple text prompts or internal documents into custom, interactive training modules and quizzes, no instructional design team required.
- Deepfake Training Content Agent: Safely simulate hyper-realistic executive impersonations, giving your workforce the hands-on experience needed to spot next-gen social engineering tactics before they lead to a costly mistake.
- Studio-Quality AI Videos at Scale, Powered by Synthesia: Generate professional video training modules with realistic AI avatars and seamless localization across 130+ languages — no production budget required.
The threats targeting your organization are custom-built. Your training should be too. Watch now and see how KnowBe4 puts the power of custom, relevant security awareness training directly in your hands.
Watch Now:
https://info.knowbe4.com/kmsat-demo-3?partnerref=OD
Trust, Verify, Protect: Modernizing Email Security for the Cloud
By Dr. Kawin Boonyapredee
Picture this: Your company just fell victim to a massive data breach. The culprit wasn't a sophisticated malware strain, a zero-day exploit or a compromised firewall. It was a perfectly legitimate-looking login from a VP's account, originating from an unrecognized IP address, requesting an urgent wire transfer via a spotless, text-only email.
In the modern threat landscape, attackers have realized something crucial: Why break in when you can just log in?
As organizations shift to the cloud, the line between email security and identity management has blurred entirely. Traditional email security is failing because it's looking for bad files, while attackers are busy stealing good identities. Here is how cloud email security should work in a world dominated by identity-first attacks.
The Core Problem: The Legacy Email Security Mirage
For decades, Secure Email Gateways (SEGs) acted as the bouncers of the corporate network. They inspected incoming traffic at the perimeter, checking for known bad signatures, malicious attachments and sketchy URLs.
But in a cloud-first world (think Microsoft 365 and Google Workspace), the perimeter no longer exists.
Attackers use trusted infrastructure: Phishing pages are hosted on legitimate SharePoint or Google Drive links.
Payload-less attacks dominate: Business Email Compromise (BEC) and vendor email compromise often contain zero links and zero attachments. They rely purely on social engineering and identity impersonation.
The attack happens inside the house: If an attacker compromises a user's credentials via a session hijacking attack, they can send malicious emails internally. A traditional SEG will never even see it.
What is an Identity-First Attack?
Identity-first attacks target the human element and the authentication mechanisms protecting your users. Instead of exploiting software vulnerabilities, they exploit trust. Common tactics include:
- Session Hijacking / Cookie Theft: Bypassing Multi-Factor Authentication (MFA) by stealing active session tokens.
- Credential Stuffing: Using leaked passwords across multiple platforms.
- Lookalike Domains and Display Name Spoofing: Creating an email address that closely resembles a company executive or trusted vendor (e.g., ceo@cornpany.com instead of company.com).
The Blueprint for Modern Cloud Email Security
To survive a world of identity-first threats, email security can no longer operate in a silo. It must evolve from a perimeter filter into an integrated, identity-aware behavioral engine. Here is what that looks like in practice:
[CONTINUED] Blog post with links:
https://blog.knowbe4.com/modernizing-cloud-email-security-identity-first
From Legacy SEGs to Integrated Cloud Email Security (ICES)
Nearly 87% of cybersecurity leaders are currently considering or have already completed the replacement of their SEG. This shift comes as sophisticated, payload-less threats increasingly bypass traditional defenses by exploiting human trust rather than technical vulnerabilities.
This whitepaper explores the fundamental shift from external gateways to Integrated Cloud Email Security (ICES). It provides a strategic framework to help you identify when a SEG has become obsolete and how to transition to a model that leverages deep API integration for superior visibility.
Your roadmap for modernizing email protection includes:
- The critical blind spots of SEG architecture and why operating outside the cloud tenant leaves your organization blind to internal mail flow and behavioral anomalies
- The power of AI-driven behavioral detection and how ICES uses machine learning to stop Business Email Compromise (BEC) and account takeovers
- A three-phase transition strategy to assess your current performance baseline, evaluate integrated platforms and execute a migration with minimal disruption
It's time to take a good, hard look at SEGs.
Download Now:
https://info.knowbe4.com/evaluating-modern-email-security-architectures-wp-chn
Report: Social Engineering Remains a Central Part of AI-assisted Attacks
Threat actors continue to rely on social engineering as AI is incorporated into their attacks, according to ESET’s Threat Report for the first half of 2026.
ESET’s Director of Threat Prevention Labs, Jiří Kropáč, stated, "Rather than relying on entirely new methods and tools, attackers are quickly adapting established techniques to new platforms, technologies and user behaviors. The number of AI skills within this new ecosystem is growing rapidly as we speak, further expanding the attack surface."
ClickFix social engineering attacks steadily increased throughout the first half of the year, as attackers improved their techniques.
"In H1 2026, ClickFix continued to spread across new environments and leverage new lures: extending to macOS through commands that supposedly install system utilities, compromising WordPress sites to show ClickFix-style prompts to site administrators and launching AI-themed waves," the report says.
"Attackers have also refined the social engineering layer, using fake blue-screen-of-death (BSOD) prompts, frozen document viewers and service specific error messages to increase the chances of successful compromise. ESET telemetry shows that detections of ClickFix attacks…grew by 108% between H2 2025 and H1 2026."
Notably, ESET is tracking a variant of ClickFix that offers advice related to generative AI tools. "Adversaries keep the social engineering aspect of ClickFix up to date by adopting what we track as AI-fix which exploits the current hype, growing popularity and availability of generative AI tools," the researchers write.
"Attackers craft pages that abuse legitimate domains – for example, Anthropic’s Artifact pages, OpenAI’s Canvas or Microsoft’s Copilot Pages – offering troubleshooting content for nonexistent issues. The user is led to believe that the instructions are AI-generated, which plays right into the attackers’ hands, as people increasingly tend to place their trust in such tools."
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
Blog Post with Links:
https://blog.knowbe4.com/social-engineering-central-ai-assisted-attacks
Phishing Security Test: Free Anti-Phishing Tool
Did you know that 91% of successful data breaches started with a spear phishing attack?
Find out what percentage of your employees are Phish-prone™ with your free Phishing Security Test. Plus, see how you stack up against your peers with the new phishing Industry Benchmarks!
IT pros have realized that simulated phishing tests are urgently needed as an additional security layer. Today, phishing your own users is just as important as having an antivirus and a firewall. It is a fun and effective cybersecurity best practice to patch your last line of defense: USERS.
Why? If you don't do it yourself, the bad actors will.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
The Phish-prone Percentage is usually higher than you expect and is great ammo to get budget. Start phishing your users now. Fill out the form, and get started immediately!
Sign Up:
https://info.knowbe4.com/phishing-security-test-em-chn
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: Yours Truly--Celebrating America 250!:
https://voicesof250.com/voices/stu-sjouwerman-readingminds-7b6fcc02-778d-4d87-ab71-a4132d0b51f2
- Horace Walpole - Writer (1717-1797)
- Albert Einstein - Physicist (1879 - 1955)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-29-clickfix-social-engineering-is-now-the-leading-malware-delivery-method
Targeted Impersonation Attacks Hit a Majority of Organizations Last Year
Fifty-three percent of organizations have had an executive or employee impersonated in targeted social engineering attacks over the past year, according to a new report from Outtake.
Social media platforms accounted for just over half of the activity, followed by video platforms.
"More than half of all alerts (53.83%) of executive impersonation threats stem from social platforms," Outtake says. "Video and visual platforms follow at 35.05%, with open community forums (6.84%) and executive lookalike domains (3.57%) rounding out the remainder.
"Yet the per-executive risk profile varies sharply: most executives (76.2%) see nearly all activity concentrated on one surface, while others (23.8%) face attacks distributed thinly across social, lookalike domains, forums and broker-site PII exposure simultaneously."
Notably, threat actors are using AI tools to dramatically accelerate these attacks. AI can speed up reconnaissance to craft convincingly spoofed profiles, while deepfake technology can generate images and videos of executives that are indistinguishable from real life.
"Attackers use AI to skip your internal security tools completely," the researchers explain. "There's less need to break through data, network, cloud and endpoint security perimeters when adversaries can just impersonate an executive out on the open internet, where those tools don't watch.
"They target your most visible leaders on purpose because a trusted name gets them to the money faster than anything inside your network. And it lands on a handful of executives, not the whole team."
AI-native security awareness training gives your organization an essential layer of defense against targeted social engineering attacks.
Outtake has the story:
https://www.businesswire.com/news/home/20260707313790/en/Majority-of-Enterprises-Hit-by-Executive-Impersonation-as-C-Suite-Becomes-the-Fastest-Growing-Attack-Surface
New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication
Researchers at ReliaQuest are tracking two new phishing toolkits that are designed to bypass multifactor authentication (MFA). The first tool, called "Jalisco," is a device code phishing platform that pairs with AI-powered phishing-as-a-service platforms like EvilTokens to provide fresh OAuth codes in real time.
"Jalisco is a device code phishing toolkit that provisions fresh OAuth codes in real time via a backend API and manages captured sessions through a web portal," ReliaQuest says. "Its use of lure-generation—a recent evolution that bypasses the 15-minute time-to-live (TTL) on device codes—neutralizes one of the core security assumptions defenders rely on to limit device code phishing.
"Its presence in the wild signals that lure-generation is highly likely to become a standard feature across a wider range of phishing kits."
The second tool, dubbed "OmegaLord," is a credential harvester that also captures phone numbers in order to intercept MFA codes. "OmegaLord is a newly discovered JavaScript-based credential harvester that goes beyond standard tools by deliberately collecting phone numbers alongside credentials, likely to intercept or hijack MFA—a signal that even traditional credential theft phishing is being engineered around modern authentication defenses," the researchers write.
"OmegaLord displays a fake PDF reader login page that prompts the user for their email address, password and phone number. Collecting phone numbers is unusual for credential harvesters and is likely intended to help the attacker intercept or hijack MFA requests during authentication."
Both of these toolkits indicate that attackers are increasingly interested in automating techniques to bypass MFA. "Neither tool exists in isolation," the researchers explain. "Device code phishing tricks users into authenticating on behalf of an attacker, bypassing MFA without exposing credentials and has surged in 2026—driven by AI-powered PhaaS kits that let any attacker impersonate any brand with minimal skill.
"Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion."
ReliaQuest has the story:
https://reliaquest.com/blog/threat-spotlight-jalisco-toolkit-and-ai-powered-phishing-surge
What KnowBe4 Customers Say
"Claire and Griffin, thank you so much for the fantastic call today. You answered many questions that I had that I hadn't even verbalized on the call. It has been a good experience working with KnowBe4 for about 9 years now and you two have continued that great working relationship. I greatly appreciate you!"
- T.M., Executive Director, Information Technology Services
- EU sanctions Russian GRU military hackers over cyberattacks:
https://www.bleepingcomputer.com/news/security/eu-and-uk-hit-russia-with-first-joint-cyber-sanctions-package/ - US and security allies warn Russian attacks on critical infrastructure are ramping up against 'poorly configured and vulnerable networking devices worldwide':
https://www.ic3.gov/CSA/2026/260713.pdf - VPN service favored by ransomware groups is sanctioned by US:
https://therecord.media/first-vpn-administrator-us-sanctions-ransomware-groups - [LEGAL INDUSTRY] The Rising Tide of AI-Enabled Social Engineering Scams: What Orgs Need to Know:
https://www.jdsupra.com/legalnews/the-rising-tide-of-ai-enabled-social-8157586/ - Attackers are targeting Celine Dion fans with phony ticket scams:
https://www.group-ib.com/blog/fake-concert-ticket-scam-celine-dion/ - Dutch police bust investment fraud ring stealing over €100 million:
https://www.bleepingcomputer.com/news/security/dutch-police-bust-investment-fraud-ring-stealing-over-100-million/ - Now, even Russia’s most elite hackers are using ClickFix to infect devices:
https://arstechnica.com/security/2026/07/now-even-russias-most-elite-hackers-are-using-clickfix-to-infect-devices/ - Iranian APTs are using AI to enhance their operations:
https://www.recordedfuture.com/research/iran-ai-asymmetric-playbook - Ransomware activity continues to increase:
https://www.cybersecuritydive.com/news/ransomware-concentrated-ai-guidepoint/824828/ - Russian criminal group uses Trojanized software applications to target users in the US and Europe:
https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
- Virtual Vaca #1 - Great Basin National Park Travel Guide - Nevada’s Last Glacier & Oldest Trees:
https://youtu.be/_ejG5XB01IA - Virtual Vaca #2 - MAURITIUS TRAVEL Top Places & Best Things To Do:
https://youtu.be/UB3dH4Y08DI - Virtual Vaca #3 - Top 10 Things To Do In Maine, USA:
https://youtu.be/oh4oILA80ng - Kwikset’s Combination Lock Bungle:
https://www.youtube.com/watch?v=21TGBf09GsY - Going the Extra Mile with Spot from Boston Dynamics:
https://youtu.be/EI1zFxLVkrs - Extreme Skills & Talents, The Best of July 2026:
https://youtu.be/u9gW3XALABI - This Shape Shouldn't Exist:
https://www.youtube.com/shorts/PHTE66b5WEs - Lewis Hamilton takes to the skies in a fighter jet:
https://youtu.be/MGCzC-kEM1c - The Most Powerful and Fastest Audi called Nuvolari:
https://youtu.be/vqVDw6Ahbeo - Have We Finally Built Too Thin?:
https://youtu.be/jwDDihSijzk - Need some space? Cinematic Nature Vol.4: Majestic Aerial Landscapes:
https://youtu.be/ysbdU0lfbSg - For Da Kids #1 - Mother Horse Asks Stranger For Help:
https://youtu.be/tTIj4sI3M1Y - For Da Kids #2 - Rescued Tiger Discovers His Favorite Giant Red Ball:
https://youtu.be/ezoDwf0PIZI - For Da Kids #3 - Mom Makes Charcuterie Board For Rescue Dog Who Refuses To Eat:
https://youtu.be/mqQGOc3okdg - For Da Kids #4 - Couple Rents An Airbnb And Goes Home With A 1-Pound Kitten:
https://youtu.be/7zWikOvA0tI - For Da Kids #5 - People Thought This Mama Duck Was Attacking Her Baby:
https://youtu.be/3P_S4fT40iU
