Most write-ups treat vishing, ClickFix and adversary-in-the-middle phishing as separate techniques. In practice, a determined caller will happily use all three on the same person in the same afternoon, moving on to the next one...

For years the standard advice for phishing-resistant… well, phishing, was simple: turn on MFA. Adversary-in-the-middle phishing, AiTM for short, is the reason that advice stopped being sufficient on its own. An AiTM attack doesn’t try...

Most security awareness training still teaches people to spot a fake login page - a suspicious domain, an unexpected password prompt or a page that just doesn’t look quite right. OAuth consent phishing, sometimes called...