When a call comes in from someone claiming to be your IT help desk, urging you to update your passkey or risk losing access to your Microsoft 365 account, most employees comply. That instinct is precisely the entry point that threat actors are targeting. In advisory AL26-010, published this year, the Canadian Centre for Cyber […]
Vishing Awareness: When SaaS Becomes the Attack Surface Read More »
A text message arrives on the phone of a Canadian nonprofit’s finance manager, appearing to be from a trusted bank contact with the right account details, asking for a wire transfer before end of day. The manager complies. The message was not from the bank. Across every sector, Canadian organizations are encountering this scenario at
Smishing Prevention in the Age of AI Voice Cloning Read More »
Most ransomware awareness training programs teach employees to recognise malicious attachments, suspicious links, and spoofed sender addresses. That coverage is necessary but no longer sufficient. The ShinyHunters campaign targeting healthcare organisations, reported by HealthSystemCIO on September 10, 2026, reveals the gap: ransomware actors now routinely begin their attack with a phone call, not an email,
What Ransomware Awareness Training Misses About Vishing Read More »
Voice phishing has quietly overtaken email as the preferred entry point for attackers targeting organisations, and no amount of technical filtering closes that gap without genuine behaviour change. According to Google Cloud’s Mandiant M-Trends 2026 report, vishing accounted for 11 per cent of all confirmed initial access methods observed across more than 500,000 hours of
Behaviour Change Cybersecurity: Beating Voice Phishing Read More »
On 21 August 2026, Apollo Global Management disclosed a data breach: between 6 and 10 July, attackers had gained unauthorised access to several of the firm’s cloud platforms and exposed names, dates of birth, home addresses, and Social Security numbers belonging to an unknown number of people. Apollo manages more than one trillion dollars in
Vishing Awareness Lessons from the Apollo Data Breach Read More »
On August 22, 2026, an employee at ReliaQuest, a cybersecurity firm, received a phone call from someone claiming to be a named member of the company’s own security team. The caller directed the employee to authenticate through what appeared to be the company’s single sign-on portal. The employee did. The site was a fake, the
Social Engineering Defence in the Age of Vishing Read More »
A phishing campaign that has been quietly running for at least five months just exposed a hard truth about employee training programs. When threat researchers at CTM360 published their RecruitTrap findings in August 2026, they mapped more than 3,000 phishing URLs impersonating recruiters from over 50 real organizations. The primary victims were marketing professionals, and
The Phishing Simulation Your Marketing Team Is Missing Read More »
In January 2026, attackers gained access to the personal and financial records of 889 Starbucks employees without ever penetrating the company’s core infrastructure. The method was precise: a convincing replica of Starbucks’ Partner Central, the internal portal workers use to manage payroll, benefits, and employment details, was built to harvest credentials. Workers who entered their
Behaviour Change Cybersecurity: The Starbucks Portal Lesson Read More »
On August 10, 2026, CISA, the FBI, the National Security Agency, and South Korea’s National Police Agency issued a joint advisory warning organizations worldwide about Gunra ransomware, a fast-growing criminal operation that has already claimed Canadian victims. Advisory AA26-222A names healthcare providers, nonprofit services, financial institutions, and government agencies as active targets and describes an
Ransomware Awareness Training: Gunra Targets Nonprofits Read More »
The message from Black Hat USA 2026, which concluded in Las Vegas on August 7, was directed squarely at organizations still running annual click-training programs: the attackers have moved on, and so must you. Researchers documented a threat landscape in which AI tools produce flawless phishing emails at 95 percent lower cost than manual campaigns,
Behaviour Change Cybersecurity: 4 Lessons from Black Hat Read More »
