Discover the latest articles published by the SUCURILABS team about CTI, DFIR, Human risk management and more.
SaaS abuse turns legitimate notifications, shared files, and app permissions into attack paths. Learn how it works, what to look for, and how to prevent it.
By Hugo Eusébio
AI has not reinvented Business Email Compromise. It has made it faster for attackers to research people, personalize messages, manage conversations, and impersonate trusted identities.
An SVG attachment can redirect a recipient to a phishing page. Learn how to spot and safely investigate suspicious SVG files.
MFA can stop stolen passwords, but attackers increasingly target the authentication flow itself. Learn how MFA bypass works, see real-world examples, and understand which controls make these attacks harder.
VENOM shows how modern phishing can combine QR codes, anti-analysis techniques, AiTM infrastructure, and legitimate Microsoft authentication flows to steal access even when MFA is enabled.
Learn how changes in a trusted vendor relationship can expose account compromise and guide a focused security investigation.
Learn how API-based email security analyzes Microsoft 365 messages after delivery, what access it requires, and which questions to ask before deployment.
Learn how email security combines authentication, behavioral analysis, machine learning, link inspection, and campaign data to explain suspicious messages.
Learn how email can carry indirect prompt injections, which signals defenders can investigate, and how to limit AI access before an attack causes harm.
Learn how prompt injection can hijack AI tasks, how direct and indirect attacks differ, and which controls can limit the damage.
QR code phishing hides malicious links inside images and attachments. Learn the detection signals, investigation steps, and controls that help stop quishing before credentials are stolen.
QR code phishing, or quishing, hides malicious links inside QR codes to move victims from email to mobile credential theft. Learn how it works, why it bypasses traditional defenses, and what signals security teams should watch.
Learn how Business Email Compromise attacks abuse trusted identities, urgent business requests, and compromised mailboxes to manipulate payments, payroll changes, credentials, and sensitive data.
A deeper look at how attackers use compromised mailboxes to bypass trust controls, hijack conversations, and launch BEC and VEC attacks against employees, customers, and vendors.
Learn how infostealers steal passwords, session cookies, and tokens that can give attackers access to real mailboxes, real conversations, and the business context needed for BEC, VEC, internal phishing, and invoice fraud.
Learn how generative AI is making phishing emails more personalized, scalable, grammatically clean, and harder to detect and why modern email security must focus on intent, behavior, context, and anomalies.
Fake domains are used to impersonate trusted brands, steal credentials, mislead customers, and launch phishing attacks. Learn how typosquatting works and why companies need to detect it early.
Learn how ClickFix attacks use fake errors, CAPTCHAs, and technical instructions to convince users to run malicious commands and compromise data.
Learn how ICS phishing attacks use calendar invites and .ics files to steal credentials, bypass email filters, and manipulate your team.
Learn how OAuth App Abuse attacks exploit cloud application permissions to access emails, files, and financial data without directly stealing passwords.
Discover how artificial intelligence is making financial phishing attacks more realistic, personalized, and harder for Finance teams to detect.
Learn how CEO Fraud attacks fake approvals from CEOs, CFOs, and senior managers to manipulate payments, bypass internal controls, and deceive finance teams.
Understand the difference between Business Email Compromise and Vendor Email Compromise, how these attacks are connected, and how to protect your company from financial fraud.
Discover how thread hijacking attacks use legitimate email conversations to manipulate payments, change financial instructions, and deceive finance teams.
Learn how Payment Redirection Fraud works, a scam that manipulates invoices, suppliers, and financial processes to divert business payments.
Learn how Vendor Email Compromise attacks exploit trusted suppliers to steal money, credentials, and business data.