On October 15, 2026, attackers used a single stolen application credential from ConnectWise’s SkyKick cloud backup service to sign into 173 Microsoft 365 tenants. No employee clicked a phishing link. No one handed over a password. The breach happened through a third-party vendor application that had been granted privileged access to customers’ environments, no human […]
Insider Threat Awareness Starts with Vendor Access Read More »
When Microsoft and its partners dismantled a massive Chinese-language phishing network this week, they were not just stopping spam. They were cutting off infrastructure that makes business email compromise possible at scale. Since January 2026, three interconnected platforms sent over one billion phishing emails and text messages to more than 75,000 organizations worldwide, according to
Industrial Phishing Fuels Business Email Compromise Read More »
Every October, Cyber Security Awareness Month gives Canadian organizations a prompt to take stock of their readiness. This year, the Communications Security Establishment (CSE) launched Cyber Month 2026 under the theme “Your best defence is you,” and the message carries more weight than in previous years. A 2026 Get Cyber Safe survey found that 59
Security Awareness for Nonprofits: The AI Phishing Gap Read More »
When a threat actor impersonates a trusted contact inside your organization, the question is not whether your firewall can stop them. It is whether your employees are trained to pause before they comply. That is the lesson inside the ASOS data breach confirmed this week, and it applies to every Canadian organization with more than
ASOS Breach: The Behaviour Change Cybersecurity Lesson Read More »
Canadian organizations are spending more on cybersecurity, and they are not getting more secure. According to CIRA’s 2026 annual survey, released during Cybersecurity Awareness Month, 76 per cent of Canadian organizations increased their cybersecurity budgets over the past year. Yet only 67 per cent believe that investment is sufficient, a drop from 74 per cent
Security Awareness Metrics Reveal Canada’s 2026 Budget Gap Read More »
Your employees have been trained not to click suspicious links in email. They have learned to pause before acting on an urgent wire transfer request. But what happens when the phishing message arrives from a trusted AI assistant inside your own Slack workspace, speaking in its usual helpful tone? A set of vulnerabilities disclosed this
SalesBleed: When AI Agents Enable Business Email Compromise Read More »
A British Columbia-based property management company became the latest Canadian organisation added to Clop ransomware’s extortion list on September 23, 2026, when the group claimed responsibility for an attack against CCCM-BC.CA and threatened to publish stolen data unless the company entered negotiations. The specific volume of data involved has not been publicly disclosed, but Clop’s
Clop Hits BC: Why Ransomware Awareness Training Matters Read More »
On September 22, 2026, Microsoft and a coalition of technology partners dismantled EvilTokens, an AI-powered phishing service that had compromised more than 12,000 Microsoft 365 inboxes across 10,000 organizations worldwide. Canada was among the countries specifically named as a victim zone. If your organization uses Microsoft 365, this story concerns you directly. How Device-Code Phishing
EvilTokens: Security Awareness for Canadian Organizations Read More »
On September 22, 2026, Microsoft’s Digital Crimes Unit seized 50 websites and disabled more than 150 domains tied to EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 inboxes across more than 10,000 organisations worldwide. Two men, aged 32 and 38, were arrested by British police earlier this month in connection with the operation. Canada
EvilTokens: AI-Powered Business Email Compromise at Scale Read More »
On September 18, 2026, the FBI, Japan’s National Police Agency, Australia’s Australian Cyber Security Centre, and Germany’s federal security agencies issued a joint advisory about a North Korean state-sponsored group called WaterPlum. Between December 2025 and July 2026, the group infected more than 30,000 devices across 100 countries and stole $10.71 million from roughly 7,000
Fake Job Interviews Expose Security Awareness Training Gaps Read More »
