KnowBe4 Blog

Security Awareness Training

Read the latest news about security awareness training, best practices, why you need it, and what happens when you don't have it in place.

[HEADS UP] There's No Beta for Cyberpunk 2077

Scammers are sending phishing emails purporting to offer beta access to the highly anticipated video game Cyberpunk 2077, Eurogamer reports. These scams have been occurring for at least a ...

An Embarrassment of Riches: Malicious Actors Target AWS Accounts

Amazon is an obvious target for malicious actors looking to leverage the trust and authority enjoyed by a widely known online service or brand in malicious emails and social engineering ...

Conversations with a Phisher

Phishing campaigns display varying levels of sophistication depending on how much time and effort the attackers are willing to invest in a particular target, according to Steven Murdoch, ...

[Heads Up] DarkSide: Sophisticated New Customized Ransomware Strain Demands Millions Of Dollars

Breaking News: A new ransomware operation named DarkSide began attacking organizations earlier this month with customized attacks that have already earned them million-dollar payouts. But ...

New Vishing Scam Targets Diners at London’s Prestigious Ritz Hotel

Aimed at stealing credit card details from restaurant patrons, this new scam feels like it’s something we’re going to hear about a lot more.

The Most Effective Attacks Are Often the Simplest

The recent Twitter hack shows that devastating security breaches don’t always involve sophisticated actors or methods, according to Rachel Tobac, CEO of SocialProof Security. On the ...

Social Media Doppelgangers Strike Again

Most people would be surprised by how easy it is to scam people online using duplicate versions of public accounts, according to Jake Moore, a security specialist at ESET. Moore describes ...

Phishing Site Takes Brand Impersonation to a Whole New Level Pretending to be FINRA

Most scammers simply grab a company logo, or perhaps a logon page to make it appear like the website used as part of a scam is legitimate. But how about an entire website?

Credential Stuffing Attacks Shut Down Canada's Revenues Service

The Canada Revenue Agency is investigating two online hacking incidents affecting the personal information of thousands of Canadians, according to CBC News.

U.K. Firms Have Dismissed Employees for Breaching Cybersecurity Policy Since COVID-19 Pandemic

Almost two-fifths of business decision-makers have fired employees because of a cybersecurity policy breach since the pandemic began, a survey has found.

ABC News Interviewed Me on South Carolina Man Finding Personal Information of WWE Star and Raiding Her Home

A man in South Carolina was just arrested after finding the personal information of WWE Star Sonya Deville, and ABC Action News Tampa Bay interviewed me about how we can prevent ...

The Celebrities Don't Know You, and You Don't Know Them

Over the past four months, the UK’s National Cyber Security Centre (NCSC) has shut down more than 300,000 URLs linking to investment schemes that fraudulently claim to be endorsed by ...

Trying for a win, win, win game. Listen to this 5-minute interview with me.

Cyberwire has a short-form podcast called Career Notes and interviewed me recently. They said: "Founder and CEO Stu Sjouwerman takes us on a journey of how his career developed from ...

Phishing Golden Hour

In emergency healthcare settings, the “golden hour” is the time between when a patient suffering a life threatening event (e.g., heart attack, stroke, aneurysm, etc.) is most likely to ...

[Heads Up] Apparently Slack Phishing Got So Bad They Had To Do Something About It

Slack has announced a slew of new security features, certificates and integrations, including a verification system that adds an additional layer to protect against phishing scams.

Cybercriminals Target Execs in Microsoft 365 Credential Attack to Launch Internal BEC Scams

A new phishing attack spotted in the wild by security researchers at Trend Micro demonstrates how compromised data in an initial cyberattack is purposed in subsequent attacks.

Many US States Requiring Training on COVID-19 Before Return to Work

Many states across the US are now mandating that organizations provide training to your employees before they can return to work. Definitely check your local state guidelines but KnowBe4 ...

Legitimate Accounts for Illegitimate Business Email Compromise

Cybercriminals frequently use email accounts from legitimate services like Gmail to carry out business email compromise (BEC) attacks, Help Net Security reports. Researchers at Barracuda ...

SBA Phishing: Malicious Actors "Return to Roots" in the Hunt for Money

By Eric Howes, KnowBe4 Principal Lab Researcher. The COVID-19 pandemic continues to dominate news headlines as well as the development of malicious email attacks designed to separate ...

Cyberattacks Involving Both Data Exfiltration and Ransomware to Ensure Ransom Payment Increase 152%

Ransomware authors are realizing the benefit of either stealing data or just implying they have and threatening to publish the data publicly in order to increase their chances of being ...