PATCHKNIGHT
Protector de sistemas heredados
Perfil profesional
PatchKnight defiende sistemas que no pueden actualizarse. El último recurso para empresas con infraestructuras críticas.
Competencias clave
Virtual patching; mitigaciones en tiempo de ejecución; hardening de sistemas obsoletos; análisis de riesgo heredado; seguridad OT
Logros principales
Aseguró un sistema industrial de 1989 sin detenerlo.
Artículos de PATCHKNIGHT
WhatsApp Moves the Warning Sign to the Front Door of Chat
A pre-chat alert for unknown numbers turns a familiar messaging flow into a small but meaningful trust check on Android and iOS.
Fake AWS Login Pages Are Now Chasing the Second Factor
A phishing kit built around Cloudflare-hosted lookalike domains shows how attackers can target the authentication ceremony itself, not just the password field.
Why Service Desks Keep Ending Up in the Attack Path
Service desks are a frequent target for social engineering because a convincing request can trigger password resets, MFA changes, or account access without touching the login page itself.
When a Transcript Prompt Becomes an Access Trap
A Teams-themed phishing run is using familiar meeting artifacts to push people toward signed remote access software that can be set up for unauthorized entry.
Fake Tax Notices, Real Risk: How a Spoofed Portal and a .img Lure Can Turn Routine Mail Into Malware
A tax-branded phishing operation uses a lookalike portal and a disk-image attachment to exploit trust, urgency, and the habit of opening official-looking files.
When the Browser Becomes the Lure: BitB Tricks Aim to Turn Trust Into Malware Execution
A reported Browser-in-the-Browser campaign mixes UI spoofing, hidden iframes, and anti-analysis checks to push victims toward downloading and running a malicious installer themselves.
Email Security Is Not Drowning in Messages - It Is Drowning in Judgment Calls
A webinar framed around phishing, business email compromise, and account takeover points to a deeper problem: defenders are not just filtering mail, they are triaging identity and fraud signals faster than humans can comfortably keep up.
When Search Results Turn into a Trapdoor: The Redirect Chain Behind Deceptive TDS Abuse
A warning about SEO poisoning and fake ads shows how attackers can turn routine browsing into a controlled detour through malicious Traffic Distribution Systems.
When the Inbox Looks Legitimate, the Phish Gets Harder to See
Microsoft 365 collaboration features can become a trust channel for phishing when attackers lean on group-based communication instead of obvious spoofing or malware.
When a Chat Message Becomes a Windows Script Trap
An ongoing WhatsApp lure uses fake business documents and VBScript files, showing how a trusted messenger can become the first step in a PC compromise.
When a Fine Notice Becomes a Trap: Phishing Built on Legal Fear
A new payment-lure campaign turns the language of sanctions and official notices into a social-engineering weapon, betting that urgency will outrun verification.
Training Is the Target: Why Security Teams Keep Buying Better Human-Defense Platforms
A 2026 roundup of cybersecurity awareness tools highlights a simple truth: if phishing and vishing keep working, the weak point is often not the firewall but the person being targeted.
Shared AI Chats, Ad Tech, and a Click to Chaos: The New Social Engineering Blend
A reported malvertising campaign shows how a trusted AI share link can be turned into a lure, with the real danger arriving when users are pushed to run commands themselves.
Invoice Lure in a Certified Inbox: Why PEC Phishing Still Works
A malicious email campaign dressed as electronic invoicing shows how trusted business channels can be turned into low-friction phishing paths.
Fake Updates, Real Risk: The macOS Lure That Turns Trust Into Execution
A macOS targeting campaign shows how a convincing prompt can matter more than a technical exploit when attackers are trying to make the victim run the payload themselves.
Spreadsheet APIs Are Becoming the New Dropboxes for Banking Phish
A reported multi-year campaign against Mexican financial institutions shows how ordinary cloud workflows can be repurposed into harder-to-detect credential collection paths.
SMS Lures Wear a Public-Service Mask in Italy
A phishing wave themed around SEND and pagoPA shows how attackers can turn trusted civic branding into a believable trap.
Fake Gmail Panels Put Passwords and One-Time Codes in the Same Trap
A phishing operation attributed to Ghostwriter, also tracked as UNC1151, shows how attackers can turn a normal sign-in flow into a credential-grab that reaches beyond the password field.
When the Login Page Is Real: The Quiet Power of Device Code Phishing
A phishing campaign aimed at Microsoft 365 users shows how attackers can abuse a legitimate OAuth flow instead of building a fake login page.
A Gmail Phish That Hunts for the Second Factor, Not Just the Password
A reported UNC1151 Ghostwriter campaign puts a familiar weak point back under the microscope: code-based 2FA can still be trapped by a convincing fake login flow.