PhishFort

07/03/2026

Did you know someone's home router could be used to attack corporate networks, without anyone knowing?

That's how IoT botnets combined with residential proxy pools work: attack traffic from IPs that look completely normal.

We published the breakdown on the blog 👇

Compromised smart home devices route attack traffic through legitimate residential IPs — bypassing your perimeter controls. Here's how it works and what stops it.

07/02/2026

In the gambling industry, a fake site using your brand isn't just a fraud problem — it's a compliance one.

We recently helped a global sportsbook operator neutralise 1,400+ threats, including infrastructure designed to bypass geofencing controls.

Full case →

How a global sportsbook operator dismantled geofence-bypass attack infrastructure and neutralised 1,400+ threats with PhishFort.

07/01/2026

📍 IGB Live London — today.

Monday we published the case: 4,700+ threats, 98.9% takedown rate.

Today we're at the event to talk about what's behind those numbers.

06/30/2026

Attackers are hosting phishing on sites.google.com.

Valid HTTPS. High-reputation domain. Bypasses most filters.

LotL using Google's own infrastructure → infostealers + crypto drainers.

Breakdown: https://phishfort.com/google-sites-phishing-lotl-attacks/

Threat actors are using sites.google.com to host fake Workspace portals that deploy infostealers and crypto drainers. Here's how the attack works.

06/29/2026

800 threats a year, managed manually. 😵‍💫

Not to brag, but... after twelve months with PhishFort: 4,700+ detected and actioned. 98.9% takedown success rate. 38 average hours from detection to offline.

The problem wasn't the team. It was visibility.

A global iGaming operator with millions of active players had no idea what was happening out there. Fake casinos, cloned login pages, typosquatted domains active across Europe and LATAM — all invisible until we mapped them.

We're proud to share the full case today: https://phishfort.com/success-cases/igaming/

P.S. If you're chasing threats like these and you're at IGB Live London this week — we'll be there Wednesday. Come find the team.

How a global iGaming operator went from handling ~800 threats a year manually to detecting and actioning 4,700+ in twelve months with PhishFort.

06/19/2026

Friday thought before you close the laptop:
"A takedown closes one incident. It doesn't stop the campaign".

In most persistent phishing operations targeting fintech and crypto firms, a taken-down domain is replaced within 24–72 hours. Malicious apps pulled from app stores reappear under a new developer account within days.

Here's why:

🔁 Attackers pre-register domain inventories — 10, 20, sometimes 50 variants across TLDs and ccTLDs. Reactive takedowns typically catch 20–30% of a campaign's total inventory.

⚡ Fast flux infrastructure means a domain can keep resolving even after the hosting provider acts. Only a registrar-level suspension stops it, and many teams are targeting the wrong layer.

🎭 Content cloaking lets fake domains sit dormant (serving benign content) until they age past automated risk scoring thresholds. Then the malicious content goes live.

📱 App store removals don't stop repackaged re-submissions. A $25 developer account and a new icon is enough to get back in the store within 48–72 hours.

The common thread? Every re-emergence pattern exploits the gap between a takedown event and the next monitoring cycle.

Reactive monitoring creates windows measured in days. 24/7 continuous monitoring — flagging new registrations by brand pattern before content is served — closes that window before the replacement domain establishes itself.

A takedown without continuous monitoring is just a delay.

06/18/2026

Already watching the World Cup? 🏆
So are the scammers. 👁️

Last week we covered how the hashtag was already a brand threat for gambling platforms. This week, our researchers went deeper, and what they found is worth flagging before the weekend.

We published the full breakdown of how the attack chain works — stages, data collected at each step, and what teams should be tracking now.

PhishFort researchers identified multi-stage fake FIFA ticketing sites harvesting credentials, PII, and payment data. Here's how the infrastructure works and what to monitor.

06/16/2026

📢 🚨 UPCOMING LIVE WEBINAR — June 25 · 11:00 AM EST

Fraud has nearly tripled in a decade.

It's now your CEO's #1 cyber concern — ahead of ransomware.

And most security teams still don't have a number for it.

Join Julian Drangosch for a live, data-driven briefing on the real economic impact of phishing in 2026.

→ Why fraud has overtaken ransomware on the board agenda

→ The double-edged role of AI in today's attacks

→ Where legacy systems and third-party risk are creating your biggest exposure

→ What the global skills shortage means for your supply chain

SAVE THE DATE!

📅 Thursday, June 25 · 11:00 AM EST / 8:00 AM PT

CISOs, brand protection leads, and SOC managers — this one's built for you.

🔗 Register here!

Fraud has nearly tripled in a decade and is now the #1 CEO cyber concern. Join PhishFort for a live, data-driven briefing on what the numbers mean for your organization.

06/16/2026

Here's something worth thinking about over the weekend.

A couple of days ago, an attacker took over the White House Instagram account. No zero-day. No phishing kit. They just sent a polite message to Meta's AI support system — and it complied.

The AI wasn't broken. It was doing exactly what it was designed to do: be helpful.

That's the problem.

We wrote about the gap between AI as a tool and AI as a gatekeeper — and what adequate controls actually look like.

How attackers bypassed Meta's AI support with a 30-word prompt and took over the White House Instagram, and what it means for your security architecture.

06/15/2026

Most banks and fintechs evaluate phishing domain takedown services by comparing price tiers.

They rarely ask the questions that actually matter when a campaign hits 40 domains at 2 am on a Friday 😵‍💫

We put together 10 non-negotiable features security teams should require before signing with any vendor:

✅ Sub-24h SLA — per domain, not per campaign
✅ ccTLD coverage with real registrar relationships
✅ Structured evidence kits — not just screenshots
✅ 24/7 monitoring + human analyst validation
✅ Zero-integration deployment
✅ Parallel processing for multi-domain campaigns
✅ Transparent SLA tracking per incident
✅ Escalation paths beyond registrar abuse
✅ Evidence output compatible with compliance workflows
✅ Per-incident option for low or irregular volume

Most services check 3 or 4 of these.
Few check all 10.

Full breakdown in our latest article 👇

Most banks and fintechs evaluate phishing domain takedown services the wrong way. They compare price tiers and sales decks.