From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Phishing campaign targeted Flipper Zero buyers

Trying to phish anyone who knows about Flipper Zero is a bold move.

Billy Hurley

Even phishers want to offer good customer service.

‘Caffeine’ phishing service offers end-user perks for future customers

A sophisticated SMS attack targeting Twilio employees highlights text-based phishing as a major threat.

Twilio ‘smishing’ attack compromised around 125 corporate clients, including Signal

All the fish are the same color orange except one who is purple

Phishing

Brianna Monsanto

When KnowBe4 data-driven defense evangelist Roger Grimes reveals his employer to people, he is typically met with one response.

“The first year or two I was at KnowBe4, people would say, ‘Where do you work?’ I’d go, KnowBe4 [and] they couldn’t pronounce it…Now, when I tell people I work for KnowBe4, they’re like, ‘Oh, I just failed one of your tests,’” Grimes said.

That’s because of how ubiquitous KnowBe4 has become in the cybersecurity industry. Almost 70,000 organizations rely on KnowBe4, with an upward of 50 million users using its platform everyday.

“You can go to London, you can go to Rome, you can go to New York, and everywhere it’s default. It’s KnowBe4,” co-founder and CEO of security platform Anetac Timothy Eades said.

While employees may only be able to recall failed phishing simulation tests and compliance training when they think of KnowBe4, the security awareness training company has completely turned the cybersecurity industry on its head and modernized a once antiquated way of learning. IT Brew caught up with Grimes to discuss KnowBe4’s early days and how it won the trust of thousands of companies.

 KnowBe4 was founded in 2010 by Stu Sjouwerman. At the time, Sjouwerman’s anti-malware software company Sunbelt Software had just been acquired by GFI Software.

“He sells the company, makes his millions, and within five days, he’s sitting at home bored and he’s like, ‘I want to form another company,’” Grimes said. He added that Sjouwerman had become cognizant of the threat of 

 and unpatched software, causing him to dedicate KnowBe4 to defending against such threats.

In 2011, a year after launching, Sjouwerman brought on Kevin Mitnick, a renowned hacker and security consultant, as chief hacking officer and partial owner of KnowBe4. Grimes said Mitnick, who 

, had been a “very early proponent” of social engineering. As videos Mitnick made began to gain traction, Grimes said Sjouwerman decided to focus more on training content. This move, along with a large ransomware incident at the time, propelled KnowBe4 into a state of growth.

From there, Grimes said KnowBe4 helped to quantify the extent of the social engineering problem and prove the importance of security awareness training. A 2023 KnowBe4 white paper shows that users who receive simulated phishing tests multiple times per week for more than a month saw a 96% improvement rate in their phish-prone percentage rate (KnowBe4 defines this as the “ability of a user to flag a potential phishing email”).

“Back when we started, it was just one of the problems, like bubbles in a glass of champagne,” Grimes said. “But we’re the ones to come out and say, ‘Hey, one of those bubbles is significantly bigger than all the others.’”

Making security awareness training, dare I say, fun? 

Grimes told IT Brew that part of what differentiated KnowBe4 from other security awareness training providers at the time was the platform’s ease of use.

“With some of the other competitors…you would go to an educational class and they certify you,” Grimes said. “Ours was just open up the interface and look. If you can’t be up and running within an hour, we haven’t done our job.”

However, others observed a fundamental shift in how security training was delivered and consumed after KnowBe4 hit the scene. Dev Nag, founder and CEO of QueryPal, an AI-powered ticket automation company, told IT Brew that security awareness training previously focused mainly on telling users in a simplistic manner what good cyber hygiene practices were.

“It’s almost like trying to learn how to play baseball by watching a video, but not actually ever swinging a bat,” Nag said.

Nag said KnowBe4, among others, introduced a “second generation” of training videos that not only told users what they should be doing, but also made sure they understood what they were learning in real time.

“KnowBe4 is actually like, ‘Let’s get you some bats. Let’s actually see how you swing the bat against a real live pitch and when you fail, we’ll show you how you failed and make you better at it,’” he said.

Eades added that KnowBe4’s recognition that social engineering is an “everyone problem” allowed the company to create a “go-to-market flywheel” that allowed it to penetrate the security awareness training market.

“Their M&A model was just plugging in more things that they could put into…the existing go-to-market model,” Eades said. Over the years, KnowBe4 has acquired several companies, including cloud email security firm Egress, security awareness platform SecurityAdvisor, and video production company Twist and Shout Group.

Nag said KnowBe4’s ability to invoke a “visceral experience” when training and informing end users through its video series 

, a “cybersecurity thriller” that explores different cybersecurity-related themes, was also a game changer for the company. Grimes said the ongoing, award-winning series, which now has run six seasons, has been so positively received that customers often call KnowBe4 asking when the next season is coming out. KnowBe4 data shows that those who watched between one-to-nine episodes of 

 saw about a decrease of 9 percentage points in phish-prone percentage rate.

“You know you’ve made good content when they’re calling you to get more training,” Grimes said.

 Grimes said discussions with customers and emerging threat trends help to shape the type of content the company will focus on in a given year. One of the company’s 2026 videos, for example, will focus on 

“We are sure by the end of 2025, and certainly into 2026, it’s going to be a major problem…so today, we’re making those videos and going to put them out there,” Grimes said.

As attackers continue to leverage AI to launch more sophisticated attacks at end users, Grimes suspects that 

 companies will need to leverage that same tool to deliver more tailored content.

“The future of security awareness training is this very individual, specific training curriculum just for you that is different than anybody else in your company,” Grimes said. “And that’s what we’re working toward and pushing toward.”

Eades said this transformation will be essential for every player in the market moving forward.

“You’ve got a tectonic shift coming with AI-based human attacks on the human layer,” Eades said. “The technology needs to step up and be more AI-infused because you’re going to have to fight AI with AI.”

Over the shoulder view of a young woman using laptop, using her phone to verify her password.

How cyber firm KnowBe4 gave security awareness training a much-needed facelift

“The future of security awareness training is this very individual, specific training curriculum just for you that is different than anybody else in your company,” Roger Grimes tells IT Brew. 

April Fools’ Day came late last year for employees at Albert Invent, an AI-powered research and development platform for scientists.

Last year, Albert Invent co-founder and CEO Nick Talken hired a cybersecurity firm to carry out a sophisticated spear phishing attack on a group of unsuspecting engineers at his company.

Talken, a chemist, told IT Brew that he was inclined to perform the offensive raid on his employees because the startup’s systems house the intellectual property of its consumers, which comprise Fortune 500 companies and chemical and personal care companies. That means it’s crucial the startup’s security posture is top-notch.

“A lot of them, in their own words, say that we’re housing the crown jewels of the organization, and we take that responsibility extremely seriously,” Talken said.

Talken sought the help of Coalfire, a cybersecurity and compliance service provider, to craft the elaborate phishing attack against his employees. He said he wanted Coalfire to target the employees on his team with the highest level of privileged access into its systems.

The attack was simple. Employees were sent a spear phishing email containing a malicious link, followed by a spoofed phone call from their CEO coaxing them to click it. John Hendley, VP of offensive security at Coalfire, told IT Brew that his team was able to clone Talken’s voice by inputting audio from a public webinar into an open-source model. Hendley said the tool only needed 30 seconds of audio to train with.

“We used open-source tool sets to create a facsimile of his voice, and then we used commercial spoofing software to call and spoof his phone number, to call his employees and try to get them to open a link in an email that we sent,” Hendley said. He added that anyone could perform the attack.

While Coalfire regularly offers offensive security services to clients, Hendley said Albert Invent’s request was different because Talken wanted a more advanced phishing attack simulation with AI-voice cloning.

The night before the attack, Talken said the Coalfire team used the spoofed number and cloned voice to call his wife.

“It was scary,” Talken said. “I was like, ‘This could work.’”

After the email and phone call was made to employees, skeptical employees quickly called Talken to verify what had happened.

“I was like, ‘I have no idea what you’re talking about…and by the way, you’ve passed the test. Thank you for calling me,’” Talken said. He said only a few employees clicked on the faux-malicious link in the email, though single sign-on blocked any further havoc. None of the employees gave up their credentials, and client data was never at risk during the exercise.

Looking back, Talken said the experience was “eye-opening” for his company and caused Albert Invent to “accelerate” internal changes to its system authentication.

“Everyone was secure, but it got close, and that is what we were looking for. Maybe more than anything else, it brought a heightened sense of awareness to our entire company of what is possible today.”

Two men in front of computers over purple background.

Why a science tech startup performed an offensive raid on its employees

Albert Invent CEO Nick Talken tells IT Brew the hack carried out by a cybersecurity firm was “eye-opening.”

Caroline Nihill

The Department of Education was subject to a phishing campaign that targeted the agency’s G5 portal, which handles its grant management system.

BforeAI, a company that provides predictive intelligence for attacks and digital risk protections, identified the campaign on July 15 according to 

 released by the company. The cybersecurity group found that there were “multiple lookalike domains” that were attempting to spoof the G5 login page to harvest login credentials.

Lead researcher at BforeAI Abu Qureshi told IT Brew that the company was tracking the bad actor that had been targeting insurance and HR agencies in the US, but pivoted to ED as the group started doing work to take the campaign down. Qureshi said that the phishing attempt is “very timely” with the recent layoffs from the agency.

“It’s not uncommon for actors to try and exploit these reductions in force in big companies or layoffs in [the] public sector as well, especially because the view from the attacker perspective is that public sector is not very well staffed internally to begin with for cybersecurity,” Qureshi said.

Qureshi said that currently, the victim tally is unknown and is not something they are tracking, but “the infrastructure is still live and it was live for some time…there’s a chance that there have been victims.”

These could be the same actors that BforeAI found were sending fraudulent texts to users accused of having unpaid toll fees, according to Qureshi. These actors were found to “be almost operated exclusively out of China.”

“We haven’t been able to connect the dots yet, but it’s possible,” Qureshi said. “The amount of time this has been live leads me to believe that it likely is one of those geographies that don’t cooperate with the US or even companies based in the West.”

He continued: “This is a common problem we face on the…internet mitigation, abuse mitigation side, which is dealing with unfriendly nations and dealing with operators within those unfriendly nations. Because sometimes it has to get to the level where the US government gets involved and outreach to that government—and then they kick in the door, quite literally at some point, because they will not take this down.”

The department did not respond to BforeAI’s report that the company sent through its Office of Inspector General, according to Qureshi.

ED now has a message populated on the G5 portal stating the phishing campaign “intended to steal login credentials to access grant award data and change payment instructions.” The agency advised users to type in G5’s URL directly instead of clicking links from any email.

The Cybersecurity and Infrastructure Security Agency did not respond to a request for comment in time for publication.

Phishing hook going through a mouse pointer arrow

Education Department targeted in phishing scheme

 BforeAI, a cybersecurity threat intelligence company, found evidence of a phishing scheme involving ED’s grant management system on July 15. 

If you don’t feel like reading this whole thing: Somebody snuck malicious info into an AI-assisted email summary.

A researcher submitting to GenAI bug-bounty platform 0din demonstrated how to hide a command in an email; the instructions presented a false “security alert” in a message’s AI-generated synopsis.

” reveals an inherent weakness in GenAI that is tough to defend, cybersecurity pros told IT Brew.

Kev Breen, senior director of cyber threat research at Immersive, said a GenAI prompt is always the last part of the transaction, and a clever (or even simple) prompt telling a large language model to ignore its built-in instructions can upend the technology.

“There’s always a way around it. It’s just because of the way generative AI works,” Breen said.

 showed how the right prompt could trick a large language model—not just Gemini—into extracting sensitive data and creating malicious code.

0din revealed details of the social-engineering tactic in a 

An attacker crafts a command that Gemini must include the message and its phony tech-support contact number in its summary response.

The command code, hidden in zero-size, white font against a white background, is classified as “admin,” which Gemini treats as high priority, according to the post.

After a recipient clicks “summarize this email,” Gemini reads the HTML and follows the invisible directive, attaching the false warning to the summary.

In an emailed statement shared with IT Brew, Google Workspace spokesperson Ross Richendrfer wrote that defending against prompt injections are a “continued priority” for the company. “We are constantly hardening our already robust defenses through red-teaming exercises that train our models to defend against these types of adversarial attacks,” his email read.

 against prompt-injection attacks, which included “targeted security instructions surrounding the prompt content to remind the large language model (LLM) to perform the user-directed task and ignore any adversarial instructions that could be present in the content.”

The tactic revealed by 0din, however, uses the summary feature. A targeted user potentially would be the one following the directions of the phishing message and contacting a phony tech-support pro looking for credentials or money.

Even if a company found identifiers for a specific prompt injection, too, the ways to include malicious instructions are “infinite,” Gartner VP Analyst Dennis Xu said. In the case of the 0din demo, what if you just place a 

 command in an email that’s 20 pages long? What if you make the font just gray instead of white?

“The language model…it’s like a five-year-old kid. You can easily manipulate it to do anything you want,” he told us.

Nonprofit software security group OWASP considers prompt injection a 

 for LLMs and GenAI. (Xu and Richendrfer said they had not yet seen active attacks using tactics like those revealed in the 0din post.)

Breen showed screenshots of the tactic still working on July 15. In his trial, however, the AI’s output began with, “This email includes a hidden warning in the signature.”

Immersive recently led a challenge to see if humans could trick an LLM into revealing a secret word. (Spoiler: many did.) One participant, according to Breen, got the password by asking the LLM to present an output in emojis.

“You can engineer tighter system prompts to try and force it to only behave the way you want it to behave. One of the things we learned in our challenge…is that human ingenuity always wins out.”

The Google Gemini logo, a star within a circle, hovering above a bear trap.

In summary: Researcher demos prompt-injection attack on Gemini

A bug-finder hid malicious instructions in email to mess with Google’s email-summary feature.

The hospitality industry is facing polished, personalized impersonations from cyberattackers looking for credentials and data. With AI powering sophisticated phishing and deepfakes, malicious hackers are zeroing in on hotels and booking platforms, according to pros in the field who spoke with IT Brew.

“In an industry that’s built on customer trust, the attackers are targeting the very channels that people rely on: all of the confirmation emails, SMS updates that they get, and mobile apps to deliver all of this malicious content that we’re seeing,” Pam Lindemoen, chief security officer and VP of strategy

at the cyberintelligence-sharing group Retail and Hospitality Information Security and Analysis Center (RH-ISAC), said.

 RH-ISAC shared three examples with IT Brew of recent phishing messages.

With convincing vacation images and a “Give feedback” button, one notification asks guests to rate their recent stay.

Another email, featuring familiar, palm-tree graphic design, says, “Your booking is now confirmed” complete with a booking reference and a “Manage my booking” option.

A third example revealed a replica “Rewards” page.

The phishing attack is not necessarily entirely new, according to Lindemoen; what’s novel, she wrote in a follow-up email, is the increased sophistication with which threat actors are executing these scams. GenAI tools create realistic graphics and copy in a matter of minutes, she noted.

Lindemoen said fraudsters use malicious links and PDFs to infect devices with info-stealing malware, or to send travelers to false travel sites to pull their personal information.

Adversary groups like DarkHotel, as far back as 2014, have specifically targeted 

, with false software updates on hotel wi-fi networks.

“The hospitality business: They’re kind humans. They want to please you,” Lindemoen said. “They’re preying on the actual thing that makes them trustworthy.”

According to a recently published hospitality report from cybersecurity company VikingCloud, 48% of hotel IT and cybersecurity leaders admit they lack confidence in their staff’s ability to detect or respond to AI-driven threats like deepfakes.

Deloitte’s Center for Financial Services predicts that GenAI could lead to $40 billion in fraud losses in the US by 2027.

The stakes are high, according to VikingCloud CPO Kevin Pierce, with 212 million US adults set to travel this summer. The combination of high-value customer data, seasonal surges, and overstretched IT resources creates a “perfect storm,” Pierce wrote to us, adding that cybercriminals can exploit the seasonal pressure and leverage AI-powered tools to launch large-scale attacks.

VikingCloud’s survey of 50 hotel IT and cybersecurity practitioners in North America found that 26% of respondents admitted to “limited” in-house cybersecurity expertise.

Lindemoen recommends brand-monitoring technologies, tools that use tactics like machine learning and heuristics to catch spoofed domains.

“It’s really difficult to see, it’s really difficult to fight,” she said. “It’s just exploiting brand loyalty, and it’s basically attacking the trust that you’ve built with your customers.”

Animation of lock icon inserting into a hotel keycard machine.

We’ve been expecting you: Cyberattackers target travelers

GenAI has made life easier for hospitality phishers.

A classic gift card scam has been getting an AI-powered audio remix.

In April 2024, a phisher replicated the voice of LastPass CEO Karim Toubba. The identity management firm detailed in a 

 the experience of an employee who received calls, texts, and a WhatsApp audio deepfake voicemail from the impersonated executive.

Toubba and Alex Cox, LastPass’s director of threat intelligence, shared how the company is trying to put the new threat on mute, one year on.

“These technologies pop up and you go, ‘Oh, man, I didn’t even think about that,’” Cox told IT Brew. “This is just one more episode in that arms race that we deal with in the security industry.”

 The fake Toubba told the targeted employee via voice note something to the effect of “I need help urgently,” Toubba said of the April 2024 incident; the phisher then followed up via text

The adversary went for someone on the sales team—a commonly pestered group, according to Cox, given their easily available contact information. The sales pro, 

, reported the incident to the security team.

Toubba sees the tactic as an extension of a common cyber threat: a fake email or text from a CEO asking for gift cards. “I think this is just a new channel,” he said.

On May 15, the FBI notified the public of fraudulent text and 

. The effort, the agency wrote, aimed “to establish rapport before gaining access to personal accounts,” sometimes by sending targets a malicious link under the guise of moving to a new messaging platform.

According to CrowdStrike’s 2025 threat report, voice phishing attacks increased 442% between H1 and H2 2024. While spotting only two “vishing” intrusions in January and five intrusions in February, the cybersecurity company detected 93 attempts in December.

Available voice-cloning tools require a portion of preexisting audio—say, a podcast segment or a YouTube presentation. Cox believes the voice-clone’s training data could have come from a public-facing speaking engagement—a common enough occurrence for a CEO.

Not that the LastPass duo were impressed with the replica, which Toubba said sounded “faintly” like him upon review.

“I could tell it wasn’t me,” Toubba told us, adding that sales pro could tell, too. (LastPass declined to allow the targeted employee to speak with us, citing internal policies.)

“A lot of the deepfake tools don’t require a whole lot of background data,” Cox said, noting that his team quickly notified all employees of the active campaign in the company’s security channel. “They require a little bit of basic audio, and then they can kind of roll with it. That’s one of the specters of this new AI world we’re in.”

Toubba said the company has two important measures to defend against the threat, including a clear policy defining official communication channels—and authentication controls to protect those channels.

“From a technology perspective, there is literally nothing you can do. It really comes down to training,” Lance Spitzner, a director at SANS Institute, said. “We need to train people: ‘Hey, cyberattackers are no longer going to try to fool you with email phishing attacks. They’re going to try the same scams, but on your phone.’”

While Toubba reflected on how deepfakes may someday move to video, Cox wondered when agents might join the line.

“What if I, as a bad guy, have this agentic AI and I say, ‘Watch Karim, and every time he speaks at a conference, do an audio deepfake and send it to every public-facing LastPass employee asking for gift cards,’” he said. An adversary “wouldn’t even have to monitor that,” he told us.

LastPass pros will have to be the ones doing the monitoring.

How LastPass preps for the next audio deepfaker

Having approved channels and protecting those channels, for starters.

In 2024, imitation was the sincerest form of hackery.

Security company CrowdStrike’s 13th annual global threat report found a 442% increase in voice phishing, or vishing, between the first and second half of 2024—both impersonations 

 help-desk departments and impersonations 

“A lot of this is driven by the adversaries realizing that the technical defenses are getting stronger, so they have to go after the weakest link, which is the humans,” Adam Meyers, CrowdStrike’s SVP for counter adversary operations, said on Feb. 24.

The vishing threat, according to Meyers, refers to tactics like an adversary calling up the help desk and pretending to need a password reset. (The reverse occurs, too. As 

 in January, researchers have observed adversaries flooding inboxes and then offering to “help” by taking remote control of the target’s device.)

CrowdStrike in its report noted “a massive increase” in phone-based social engineering techniques to gain initial access.

While CrowdStrike’s threat-hunting service OverWatch only noted two vishing intrusions in 2024, the numbers jumped to 33, 55, 64, and 93 in September, October, November, and December, respectively.

 all warned of fraudsters impersonating IT and help desk officials in 2024. The FBI’s 2023 Internet Crime Report, published in March 2024, showed that tech-support scams—a steadily growing tactic compared to previous years—led to 37,560 complaints from the US public for the year, and $924,512,658 in losses.

Other findings from the CrowdStrike report, published this week, included:

China-linked intrusions increased by 150% percent, across all sectors, compared to 2023 and “represent the most active targeted intrusion threats CrowdStrike Intelligence tracks.” (There was no link, Meyers noted on the call, between the increase in China-nexus intrusions and vishing spikes.)

Average breakout time—or the time it takes for an attacker to hop to another system outside of the initial entry point—fell to 48 minutes, with the fastest breakout time clocked at 51 seconds.

Almost eight in 10 (79%) of detections of CrowdStrike’s 2024 detected intrusions were malware-free, up from 40% in 2019.

Ads for access brokers, those selling the compromised entry to threat actors, increased 50% year over year.

Meyers, when asked for defenses against the IT impersonations that go beyond “awareness,” mentioned that help-desk pros conducting an identity reset need to turn video on to make ID confirmations.

Will IT pros want to take that extra step, for such a familiar process like a new password request?

“I don’t think it’s really up to the IT pros whether they want to do this or not. I think it’s a risk decision for the business to say, do we want to spend the extra resources to do this right? Or do we want to find out what happens?” Meyers told reporters.