Liat Hayun, SVP Product Management at Tenable, on ownership and exposure:
Remove “someone should fix this.”

Adopt “I am the only one who will fix this.”
“A vulnerability in a vacuum is just a line of code.”

Security teams are drowning in signals. Context defines actionability.

Read: https://www.technadu.com/from-national-security-to-enterprise-risk-turning-data-into-decisions-and-proving-excellence-has-no-gender/621106/

#WomenInCyber #ExposureManagement #SecurityLeadership #LeadHerInSecurity #Tenable

This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

The U.S. is reframing cyber strategy from pure resilience to coordinated deterrence.
At the Munich Cyber Security Conference, Sean Cairncross outlined a whole-of-government cyber approach integrating law enforcement, offensive capabilities, diplomacy, and industry collaboration.

Key focus areas:
• Raising attacker cost calculus
• Enhanced public-private intel sharing
• Addressing nation-state & ransomware ecosystems
• Promoting a “clean” allied tech stack

Is deterrence achievable in cyberspace - or structurally limited?

Source: https://therecord.media/us-wants-cyber-partnerships-to-send-message-to-adversaries

Security leaders, weigh in below.
Follow @technadu for strategic cyber intelligence.

#InfoSec #CyberStrategy #ThreatIntelligence #CISO #CyberOperations #DigitalSovereignty #Ransomware #CyberPolicy #SecurityLeadership #CyberDeterrence

Incident response isn’t a script.

If your team is just following the playbook without true situational awareness, you might be running theater, not security.

New article:
https://jimguckin.com/2026/02/11/incident-response-without-situational-awareness-is-theater/

#CyberSecurity #IncidentResponse #SecurityLeadership #CyberResilience

What if the CISO's real job is calibrating the right amount of insecurity? Information must flow. Apps must be used. Links must be clicked. To calibrate the right level of insecurity we should:

1. Learn how fast the business wants to move.
2. Define how much insecurity the organization can absorb.
3. Measure the gap between current and acceptable insecurity.

https://zeltser.com/chief-insecurity-officer

#infosec #cybersecurity #securityleadership #CISO

The Brutal Truth About “Trusted” Phishing: Why Even Apple Emails Are Burning Your SOC

1,158 words, 6 minutes read time.

I’ve been in this field long enough to recognize a pattern that keeps repeating, no matter how much tooling we buy or how many frameworks we cite. Every major incident, every ugly postmortem, every late-night bridge call starts the same way: someone trusted something they were conditioned to trust. Not a zero-day, not a nation-state exploit chain, not some mythical hacker genius—just a moment where a human followed a path that looked legitimate because the system trained them to do exactly that. We like to frame cybersecurity as a technical discipline because that makes it feel controllable, but the truth is that most real-world compromises are social engineering campaigns wearing technical clothing. The Apple phishing scam circulating right now is a perfect example, and if you dismiss it as “just another phishing email,” you’re missing the point entirely.

Here’s what makes this particular scam dangerous, and frankly impressive from an adversarial perspective. The victim receives a text message warning that someone is trying to access their Apple account. Immediately, the attacker injects urgency, because urgency shuts down analysis faster than any exploit ever could. Then comes a phone call from someone claiming to be Apple Support, speaking confidently, calmly, and procedurally. They explain that a support ticket has been opened to protect the account, and shortly afterward, the victim receives a real, legitimate email from Apple with an actual case number. No spoofed domain, no broken English, no obvious red flags. At that moment, every instinct we’ve trained users to rely on fires in the wrong direction. The email is real. The ticket is real. The process is real. The only thing that isn’t real is the person on the other end of the line. When the attacker asks for a one-time security code to “close the ticket,” the victim believes they’re completing a security process, not destroying it. That single moment hands the attacker the keys to the account, cleanly and quietly, with no malware and almost no telemetry.

What makes this work so consistently is that attackers have finally accepted what many defenders still resist admitting: humans are the primary attack surface, and trust is the most valuable credential in the environment. This isn’t phishing in the classic sense of fake emails and bad links. This is confidence exploitation, the same psychological technique that underpins MFA fatigue attacks, helpdesk impersonation, OAuth consent abuse, and supply-chain compromise. The attacker doesn’t need to bypass controls when they can persuade the user to carry them around those controls and hold the door open. In that sense, this scam isn’t new at all. It’s the same strategy that enabled SolarWinds to unfold quietly over months, the same abuse of implicit trust that allowed NotPetya to detonate across global networks, and the same manipulation of expected behavior that made Stuxnet possible. Different scale, different impact, same foundational weakness.

From a framework perspective, this attack maps cleanly to MITRE ATT&CK, and that matters because frameworks are how we translate gut instinct into organizational understanding. Initial access occurs through phishing, but the real win for the attacker comes from harvesting authentication material and abusing valid accounts. Once they’re in, everything they do looks legitimate because it is legitimate. Logs show successful authentication, not intrusion. Alerts don’t fire because controls are doing exactly what they were designed to do. This is where Defense in Depth quietly collapses, not because the layers are weak, but because they are aligned around assumptions that no longer hold. We assume that legitimate communications can be trusted, that MFA equals security, that awareness training creates resilience. In reality, these assumptions create predictable paths that adversaries now exploit deliberately.

If you’ve ever worked in a SOC, you already know why this type of attack gets missed. Analysts are buried in alerts, understaffed, and measured on response time rather than depth of understanding. A real Apple email doesn’t trip a phishing filter. A user handing over a code doesn’t generate an endpoint alert. There’s no malicious attachment, no beaconing traffic, no exploit chain to reconstruct. By the time anything unusual appears in the logs, the attacker is already authenticated and blending into normal activity. At that point, the investigation starts from a place of disadvantage, because you’re hunting something that looks like business as usual. This is how attackers win without ever making noise.

The uncomfortable truth is that most organizations are still defending against yesterday’s threats with yesterday’s mental models. We talk about Zero Trust, but we still trust brands, processes, and authority figures implicitly. We talk about resilience, but we train users to comply rather than to challenge. We talk about human risk, but we treat training as a checkbox instead of a behavioral discipline. If you’re a practitioner, the takeaway here isn’t to panic or to blame users. It’s to recognize that trust itself must be treated as a controlled resource. Verification cannot stop at the domain name or the sender address. Processes that allow external actors to initiate internal trust workflows must be scrutinized just as aggressively as exposed services. And security teams need to start modeling social engineering as an adversarial tradecraft, not an awareness problem.

For SOC analysts, that means learning to question “legitimate” activity when context doesn’t line up, even if the artifacts themselves are clean. For incident responders, it means expanding investigations beyond malware and into identity, access patterns, and user interaction timelines. For architects, it means designing systems that minimize the blast radius of human error rather than assuming it won’t happen. And for CISOs, it means being honest with boards about where real risk lives, even when that conversation is uncomfortable. The enemy is no longer just outside the walls. Sometimes, the gate opens because we taught it how.

I’ve said this before, and I’ll keep saying it until it sinks in: trust is not a security control. It’s a vulnerability that must be managed deliberately. Attackers understand this now better than we do, and until we catch up, they’ll keep walking through doors we swear are locked.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

MITRE ATT&CK Framework
NIST Cybersecurity Framework
CISA – Avoiding Social Engineering and Phishing Attacks
Verizon Data Breach Investigations Report
Mandiant Threat Intelligence Reports
CrowdStrike Global Threat Report
Krebs on Security
Schneier on Security
Black Hat Conference Whitepapers
DEF CON Conference Archives
Microsoft Security Blog
Apple Platform Security

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

#accountTakeover #adversaryTradecraft #ApplePhishingScam #attackSurfaceManagement #authenticationSecurity #breachAnalysis #breachPrevention #businessEmailCompromise #CISOStrategy #cloudSecurityRisks #credentialHarvesting #cyberDefenseStrategy #cyberIncidentAnalysis #cyberResilience #cyberRiskManagement #cybercrimeTactics #cybersecurityAwareness #defenseInDepth #digitalIdentityRisk #digitalTrustExploitation #enterpriseRisk #enterpriseSecurity #humanAttackSurface #identityAndAccessManagement #identitySecurity #incidentResponse #informationSecurity #MFAFatigue #MITREATTCK #modernPhishing #NISTFramework #phishingAttacks #phishingPrevention #securityArchitecture #SecurityAwarenessTraining #securityCulture #securityLeadership #securityOperationsCenter #securityTrainingFailures #SOCAnalyst #socialEngineering #threatActorPsychology #threatHunting #trustedBrandAbuse #trustedPhishing #userBehaviorRisk #zeroTrustSecurity

Not all #AI belongs in security decision making, and that is where many teams go wrong.

In this Brand Highlight, Sean Martin, CISSP is joined by Michael Roytman , CTO of Empirical Security, to talk about why purpose built models matter in preventative security. We cover prediction vs summarization, why retraining matters, and how data driven modeling changes security outcomes.

🎥 Watch the full conversation here: https://youtu.be/2sH5PQMHna8

Do you have a good story to tell?
We would love to help!
✨ https://www.studioc60.com

#cybersecurity #genai #machinelearning #riskmanagement #securityleadership #infosec #infosecurity

Fake employees and compromised contractors are forcing organizations to rethink vendor vetting, hiring security, and identity controls.

Our team is seeing more incidents where attackers don’t exploit vulnerabilities—they exploit trust. In the latest Cyberside Chats episode, @sherridavidoff and @MDurrin unpack Amazon’s recent incident in which a North Korean IT worker was detected through behavioral anomalies and a Russian state-sponsored campaign abusing trusted infrastructure and edge devices.

Watch or listen to hear why hiring workflows, contractors, credentials, and edge devices are now part of your attack surface and what to do about it.

Watch the video: https://youtu.be/WE8p9I3uUuA

Listen to the podcast: https://www.chatcyberside.com/e/amazon-s-deepfake-hire-and-a-5-year-espionage-campaign-what-happened/

#LMGSecurity #CybersideChats #IdentitySecurity #VendorRisk #InitialAccess #ZeroTrust #SecurityLeadership

The SEC has voluntarily dismissed its lawsuit against SolarWinds and its CISO after a judge previously rejected most of the arguments as reliant on hindsight. SolarWinds says the decision supports their position and may ease concerns among CISOs watching the case.

What should future cybersecurity disclosure requirements look like?

Share your perspective - and follow TechNadu for clear, unbiased reporting.

#Cybersecurity #SolarWinds #SEC #Infosec #CISO #RiskManagement #CyberAwareness #TechNews #SecurityLeadership