From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Tom McKay

itbrew.com

Phishing campaign targeted Flipper Zero buyers

Trying to phish anyone who knows about Flipper Zero is a bold move.

Billy Hurley

Even phishers want to offer good customer service.

‘Caffeine’ phishing service offers end-user perks for future customers

A sophisticated SMS attack targeting Twilio employees highlights text-based phishing as a major threat.

Twilio ‘smishing’ attack compromised around 125 corporate clients, including Signal

All the fish are the same color orange except one who is purple

Phishing

Cyberattackers are a lot like a straight-A student—they love going to school. And their favorite subjects might be credential theft and phishing.

According to a report from cybersecurity company Check Point Software Technologies, the education field averaged 4,356 weekly cyberattacks from January through July 2025.

The 41% year over year increase in attacks makes education the most targeted of all global sectors, the cybersecurity company wrote in an 

As highlighted in that post, phishers are exploiting back-to-school urgency to send students to fake login pages. Check Point observed that out of the 18,391 new domains related to schools, universities, and students set in July 2025, “one in every 57 [was] found to be malicious or suspicious.”

To defend against the crowded cafeteria of school cyberthreats, Check Point recommended IT pros enforce multi-factor authentication, phishing awareness for staff and students, patching (especially email and collaboration platforms), and threat-prevention tools that block malicious emails and files.

Glen Deskin, head of engineering for vertical solutions at Check Point, took IT Brew through one of the many ways a threat actor can ruin an IT director’s school day.

This interview has been edited for length and clarity.

How come there are so many attacks on the education sector this year?

There’s a higher level of success because it’s an easier target. We still hear every day that there’s another school system that got compromised. It continues to be successful. So, when bad actors continue to have success, they’re going to continue hitting those targets. Those targets are challenged by funding and challenged by expertise. They don’t have the staff in many cases. In many school systems I’ve seen where the principal is their security administrator.

What’s an example of one of the 4,356 weekly attacks? What’s a typical attack that you see at a school, and what’s the impact?

It’s not even just related to a school specifically, but it’s a phishing email attack…It might be something that tricks them into “Your grades are now posted,” and it’s going to impersonate the school’s administrative systems that say, “I need you to log in here. Put in your username, password, your credentials, your Social Security Number, and we’re going to provide you an update because you’ve got a failed grade.” They give a sense of urgency, like “you failed this class, you need to log in here and look at your grade on the system and, oh, to log in, you’re going to need to put in your Social Security Number so we can identify you.”…And so now they’ve just lost their Social Security Number, their username, their password, and maybe they even have malicious code or software now loaded on their laptop or their PC or device.

Can a student’s compromise lead to something massive, like a school disruption, or does it have to be a compromise at the admin level?

If they click on something, and then a piece of malicious software is pulled down…It could be a student’s machine, and then it laterally moves inside the network. It’ll connect to administrator machines, it’ll connect to other students, and shut the entire system down. So yes, that is possible, and has happened. If it’s, say, an administrator, what’s even more dangerous is it could get their credentials, and now you’ve not only got an ability to lock out systems, but [attackers] could steal information by logging in with those stolen credentials and then retrieving, let’s say, an entire student database.

How has social media made this challenge more challenging?

Where there’s a will, there’s a way. [Students] are always going to find ways to connect outside of those school protection systems, like, say, load up their own personal phone and connect to whatever social media platform they want. So there’s a lot of ways for them to either click on the wrong things, share the wrong information, provide the wrong credentials, and have their information stolen, which can then be used to compromise their identity, the school’s information, the school systems. The threat surface is much bigger than it was a number of years ago.

Check Point sees education as ‘most targeted’ cyberattacker sector in 2025 so far

Attackers are taking a certain industry’s IT to school.

As if QR codes needed to get any weirder looking…

Threat actors, according to recent findings from cybersecurity company Barracuda Networks, are placing tricky QR-code variations into their phishing emails. The “nested” and “split” QR codes Barracuda shared in an 

 throw off email filters and link scanners, the company said.

“When traditional email security solutions scan the message, they see two distinct and benign-looking images rather than one complete QR code,” Associate Threat Analyst Rohit Suresh Kanase wrote in Barracuda’s August report.

QR-code phishing (also known by the way-stranger-to-say term quishing) has been a popular tactic among attackers. Unlike links or hyperlinked text that people can hover over and inspect to spot a malicious URL, QR codes hide their destination.

A malicious link within the QR code could execute malware or send someone to a phony website to gain valid credentials. And if an employee uses their phone to click the QR, the action takes place beyond corporate and IT visibility.

The Anti-Phishing Working Group (APWG), observed 1,003,924 phishing attacks in Q1 2025, according to its recent report. “This was the largest number since late 2023,” the Q1 snapshot revealed. Professional services and manufacturing were the industries most often targeted by malicious QR codes, according to the APWG.

Barracuda observed phishing-as-a-service (PhaaS) features embedding a “split” QR code: two separate QR objects placed next to each other. A recipient scanning the code still gets directed to the threat actor’s page. The malicious URL is encoded across both halves and is only visible when the two parts are reassembled and scanned by a phone, according to Merium Khalid, the director of SOC offensive security at Barracuda.

“Traditional detectors don’t combine or interpret partial QR images, and since no standalone URL exists in the email body or a single image, the scanners treat the content as safe,” Khalid wrote to us in a (malware-free) email.

Barracuda’s post also pointed to a similar “nested” technique. The company highlighted how another PhaaS group placed two codes on top of each other—with one pointing to a malicious URL and another leading to Google. “This technique can make it harder for scanners to detect the threat because the results are ambiguous,” Kanase wrote.

The tactic reminds Aaron Walton, senior threat intelligence analyst at Expel, of “polyglot” malware—code that has different behaviors and file formats, and evades antimalware technologies that rely on file-format identification. A polyglot file may display as an image in one application, and a malicious script in the next.

Walton sees a larger impact from this “quirky and clever” attack, because of its connection to PhaaS platforms. “Here it’s not just one cybercriminal doing it, but it’s one criminal enabling a lot more to do the same thing. So, when they do find a successful tactic that can bypass some controls, now they’re enabling a lot of their customers to bypass those controls as well,” Walton told IT Brew.

Shane Cox, director of cyber fusion center and incident response at MorganFranklin Cyber, recommends technical safeguards like QR scanning tools that decode and preview content before launch, as well as email gateways that expand shortened URLs and analyze multistage redirects for malicious behavior.

Mobile device management policies, he wrote in an email to IT Brew, “can enforce that QR codes open only in managed browsers with safe browsing enabled, while digitally signing official organizational codes can help prevent tampering with split codes in physical spaces.”

“As organizations and individuals increasingly interact with QR-driven systems, these tactics represent a growing surface for credential theft, ransomware delivery, and fraudulent financial transactions,” he added.


Phishing hook going through a mouse pointer arrow

Phishers try out ‘split’ QR codes

What’s worse than a malicious QR code? Two malicious QR codes, cleverly arranged.

Caroline Nihill

It’s not your imagination, phishing attempts are getting better. While the tactics bad actors employ haven’t changed dramatically, their methods and scale surely have.

Abu Qureshi, the lead threat intelligence and mitigation researcher at BforeAI (the team that discovered that the 

 was subject to a phishing attempt last month), said attackers are able to use AI to personalize the social engineering that goes into phishing attempts and also quickly deploy phishing kits.

“The attackers are more adaptive, meaning that us, as defenders, we’re always trying to take the site down or deter them from creating that infrastructure or targeting that customer,” Qureshi said. “But now, with using AI, they’ll have fall-back infrastructure ready to go because they’re using hosting platforms which natively support multiple deployments at once.”

Naama Ilany-Tzur, an assistant professor at Carnegie Mellon University, found 

 that individuals respond differently to phishing attempts based on which device they’re using. She said that AI is negatively impacting the threat landscape by making it harder for individuals to know what is real and what is fake.

 released survey findings that 77% of US adults have been deceived by AI-generated content online.

For a phishing attempt to succeed, a user must collaborate with the perpetrator in some kind of way—and even though people are aware of phishing attempts, that by itself isn’t enough to effectively defend against them.

Ilany-Tzur set out to understand in her study how the upgrade in devices over the years has also changed the decision-making process for users. As time goes on, for instance, people have become more aware of the risk that is involved with using phones, computers, tablets, and other electronics.

“You would think if it’s just a matter of awareness, so the increased awareness would reduce the percentage of crimes or victims, but that’s not the case,” Ilany-Tzur said. “So, that’s the other motivation: to explain how, although awareness is rising and we progress with technology, the percentage of crimes and victims is also increasing.”

Qureshi said it is easy for humans to fall victim to the social engineering element of phishing, even if we’ve seen a certain kind of attempt multiple times and avoided it.

“On that day, it didn’t register in your mind at the time, and you clicked the link, or you downloaded the attachment, or you entered the credentials,” Qureshi said. “You can have as many safeguards as possible, but as humans, if we continue to have that lapse, phishing will never go away.”

The safeguards in place for a lot of users and organizations might not be enough, but Qureshi pointed to the need for digital preventions like multi-factor authentication and antivirus programs. He also suggested that companies require multi-factor authentication for employees.

For corporations, he said that the predictive side of defense is “no longer a luxury.” Now that AI is in the picture, professionals are “way behind again.”

“We need to study the behavior, study the attacks, study what their motives are, but also how they are performing the attacks,” Qureshi said. “When we find those breadcrumbs and those repetitive behaviors, we can start to make predictions on which infrastructure is going to be used next…We can disrupt that infrastructure prematurely, and we keep making the victim pool smaller.”

Some AI tools can be used offensively to defend against phishing attempts, but experts agree the tooling isn’t always where it needs to be.

After Ilany-Tzur published a paper, she started receiving emails asking her to speak at events with personalized messaging. Some of those emails were phishing, but she reported that it was difficult to separate the fake ones from the real.

“I’m quite concerned about AI because I know that the negative impact is already there, but the positive impact…I’m not aware of a system using AI that is doing a good job and helping people to sift between the legit and the attack,” Ilany-Tzur said.

One anti-phishing AI system in use by Bluefin Payment Systems, according to the company’s CISO Brent Johnson, is able to test links that phishers include when they use platforms like Docusign to hide malicious URLs.

“The AI tools on the defensive side are getting better and better for companies that have purchased those,” Johnson said. “I’m sure your general ones from Google or Microsoft will get it there eventually, but they’re not there yet.”

A thief surrounded by cards on fishing hooks floating above a laptop.

Bad actors are using AI, social engineering for more successful phishing attempts

You can have as many safeguards as possible, but as humans, if we continue to have that lapse, phishing will never go away,” says one threat researcher.

So, you’re always on your phone. That just means you’re tougher to phish.

A study from Carnegie Mellon University in Pittsburgh, and Ben-Gurion University of the Negev, Israel, suggests mobile device users are “more risk-avoidant than PC users” and tend to be less likely to open potentially risky messages.

The findings are a reminder for IT pros that they must keep their PC-using employees, in particular, on the edge of their computer chairs and in the know about possible threats.

“I would say alerting people faster or more often, or lowering the threshold of the alert mechanisms would be a general strategy to start handling the situation,” research co-author and Carnegie Mellon professor Naama Ilany-Tzur told IT Brew.

Phishing led all cyber-specific complaints in 2024, according to the FBI’s most recent IC3 report. The threat accounted for 193,407 out of 859,532 total complaints filed with the agency, and cost orgs a total of $70,013,036.

 With records attained from a cybersecurity network-protection startup, Ilany-Tzur and Ben-Gurion’s Lior Fink reviewed just under 500,000 anonymized URL requests made by mobile devices and PCs during one week in 2020. The team found “a positive and significant relationship between mobile device and the safety level of the target URL.”

Later, the researchers recruited workers from the Amazon Mechanical Turk (AMT) platform to perform an image-tagging task—while being interrupted with a pop-up phishing message. The test showed that mobile users were “2.67 times more likely than PC users to show risk-avoidant behavior,” or to avoid clicking the pop-up’s malicious links. A second experiment determined mobile users were 4.43 times more likely than PC users to go phish.

It’s not that people on mobile devices are making good or bad click-related decisions. It’s that they’re making 

 decisions—and that’s actually a good thing when it comes to phishing. “Mobile users address the higher cost of risk assessment by avoiding the risk rather than by succumbing to it,” the report concludes.

A smaller device and constrained environment, the authors say, increases the difficulty of risk assessment.

Ilany-Tzur theorizes that phone users are in a “mobile state of mind,” or on-the-go and experiencing a higher “cognitive load,” which leads to a more on-edge mindset.

“When you’re loaded, or even overloaded, you will tend to avoid making decisions,” she said.

PC users, according to the research, are “interacting with a larger screen and are in an environment that is less cognitively constraining, culminating in a greater likelihood of accepting the risk.”

Given the findings, orgs may want to consider creating lower thresholds for alerting those more risk-accepting PC users, she said, and enhancing protection mechanisms specifically for PC devices,” she added in a follow-up email.

Perhaps an irrational doomscroll then has its security benefits.

“The danger lurks when we are at ease, not when we are on edge,” said Ilany-Tzur.


Study: Mobile users less likely than PC users to click phishy links

Maybe a “mobile state of mind” leads to better security, suggests Carnegie Mellon research.

Brianna Monsanto

When KnowBe4 data-driven defense evangelist Roger Grimes reveals his employer to people, he is typically met with one response.

“The first year or two I was at KnowBe4, people would say, ‘Where do you work?’ I’d go, KnowBe4 [and] they couldn’t pronounce it…Now, when I tell people I work for KnowBe4, they’re like, ‘Oh, I just failed one of your tests,’” Grimes said.

That’s because of how ubiquitous KnowBe4 has become in the cybersecurity industry. Almost 70,000 organizations rely on KnowBe4, with an upward of 50 million users using its platform everyday.

“You can go to London, you can go to Rome, you can go to New York, and everywhere it’s default. It’s KnowBe4,” co-founder and CEO of security platform Anetac Timothy Eades said.

While employees may only be able to recall failed phishing simulation tests and compliance training when they think of KnowBe4, the security awareness training company has completely turned the cybersecurity industry on its head and modernized a once antiquated way of learning. IT Brew caught up with Grimes to discuss KnowBe4’s early days and how it won the trust of thousands of companies.

 KnowBe4 was founded in 2010 by Stu Sjouwerman. At the time, Sjouwerman’s anti-malware software company Sunbelt Software had just been acquired by GFI Software.

“He sells the company, makes his millions, and within five days, he’s sitting at home bored and he’s like, ‘I want to form another company,’” Grimes said. He added that Sjouwerman had become cognizant of the threat of 

 and unpatched software, causing him to dedicate KnowBe4 to defending against such threats.

In 2011, a year after launching, Sjouwerman brought on Kevin Mitnick, a renowned hacker and security consultant, as chief hacking officer and partial owner of KnowBe4. Grimes said Mitnick, who 

, had been a “very early proponent” of social engineering. As videos Mitnick made began to gain traction, Grimes said Sjouwerman decided to focus more on training content. This move, along with a large ransomware incident at the time, propelled KnowBe4 into a state of growth.

From there, Grimes said KnowBe4 helped to quantify the extent of the social engineering problem and prove the importance of security awareness training. A 2023 KnowBe4 white paper shows that users who receive simulated phishing tests multiple times per week for more than a month saw a 96% improvement rate in their phish-prone percentage rate (KnowBe4 defines this as the “ability of a user to flag a potential phishing email”).

“Back when we started, it was just one of the problems, like bubbles in a glass of champagne,” Grimes said. “But we’re the ones to come out and say, ‘Hey, one of those bubbles is significantly bigger than all the others.’”

Making security awareness training, dare I say, fun? 

Grimes told IT Brew that part of what differentiated KnowBe4 from other security awareness training providers at the time was the platform’s ease of use.

“With some of the other competitors…you would go to an educational class and they certify you,” Grimes said. “Ours was just open up the interface and look. If you can’t be up and running within an hour, we haven’t done our job.”

However, others observed a fundamental shift in how security training was delivered and consumed after KnowBe4 hit the scene. Dev Nag, founder and CEO of QueryPal, an AI-powered ticket automation company, told IT Brew that security awareness training previously focused mainly on telling users in a simplistic manner what good cyber hygiene practices were.

“It’s almost like trying to learn how to play baseball by watching a video, but not actually ever swinging a bat,” Nag said.

Nag said KnowBe4, among others, introduced a “second generation” of training videos that not only told users what they should be doing, but also made sure they understood what they were learning in real time.

“KnowBe4 is actually like, ‘Let’s get you some bats. Let’s actually see how you swing the bat against a real live pitch and when you fail, we’ll show you how you failed and make you better at it,’” he said.

Eades added that KnowBe4’s recognition that social engineering is an “everyone problem” allowed the company to create a “go-to-market flywheel” that allowed it to penetrate the security awareness training market.

“Their M&A model was just plugging in more things that they could put into…the existing go-to-market model,” Eades said. Over the years, KnowBe4 has acquired several companies, including cloud email security firm Egress, security awareness platform SecurityAdvisor, and video production company Twist and Shout Group.

Nag said KnowBe4’s ability to invoke a “visceral experience” when training and informing end users through its video series 

, a “cybersecurity thriller” that explores different cybersecurity-related themes, was also a game changer for the company. Grimes said the ongoing, award-winning series, which now has run six seasons, has been so positively received that customers often call KnowBe4 asking when the next season is coming out. KnowBe4 data shows that those who watched between one-to-nine episodes of 

 saw about a decrease of 9 percentage points in phish-prone percentage rate.

“You know you’ve made good content when they’re calling you to get more training,” Grimes said.

 Grimes said discussions with customers and emerging threat trends help to shape the type of content the company will focus on in a given year. One of the company’s 2026 videos, for example, will focus on 

“We are sure by the end of 2025, and certainly into 2026, it’s going to be a major problem…so today, we’re making those videos and going to put them out there,” Grimes said.

As attackers continue to leverage AI to launch more sophisticated attacks at end users, Grimes suspects that 

 companies will need to leverage that same tool to deliver more tailored content.

“The future of security awareness training is this very individual, specific training curriculum just for you that is different than anybody else in your company,” Grimes said. “And that’s what we’re working toward and pushing toward.”

Eades said this transformation will be essential for every player in the market moving forward.

“You’ve got a tectonic shift coming with AI-based human attacks on the human layer,” Eades said. “The technology needs to step up and be more AI-infused because you’re going to have to fight AI with AI.”

Over the shoulder view of a young woman using laptop, using her phone to verify her password.

How cyber firm KnowBe4 gave security awareness training a much-needed facelift

“The future of security awareness training is this very individual, specific training curriculum just for you that is different than anybody else in your company,” Roger Grimes tells IT Brew. 

April Fools’ Day came late last year for employees at Albert Invent, an AI-powered research and development platform for scientists.

Last year, Albert Invent co-founder and CEO Nick Talken hired a cybersecurity firm to carry out a sophisticated spear phishing attack on a group of unsuspecting engineers at his company.

Talken, a chemist, told IT Brew that he was inclined to perform the offensive raid on his employees because the startup’s systems house the intellectual property of its consumers, which comprise Fortune 500 companies and chemical and personal care companies. That means it’s crucial the startup’s security posture is top-notch.

“A lot of them, in their own words, say that we’re housing the crown jewels of the organization, and we take that responsibility extremely seriously,” Talken said.

Talken sought the help of Coalfire, a cybersecurity and compliance service provider, to craft the elaborate phishing attack against his employees. He said he wanted Coalfire to target the employees on his team with the highest level of privileged access into its systems.

The attack was simple. Employees were sent a spear phishing email containing a malicious link, followed by a spoofed phone call from their CEO coaxing them to click it. John Hendley, VP of offensive security at Coalfire, told IT Brew that his team was able to clone Talken’s voice by inputting audio from a public webinar into an open-source model. Hendley said the tool only needed 30 seconds of audio to train with.

“We used open-source tool sets to create a facsimile of his voice, and then we used commercial spoofing software to call and spoof his phone number, to call his employees and try to get them to open a link in an email that we sent,” Hendley said. He added that anyone could perform the attack.

While Coalfire regularly offers offensive security services to clients, Hendley said Albert Invent’s request was different because Talken wanted a more advanced phishing attack simulation with AI-voice cloning.

The night before the attack, Talken said the Coalfire team used the spoofed number and cloned voice to call his wife.

“It was scary,” Talken said. “I was like, ‘This could work.’”

After the email and phone call was made to employees, skeptical employees quickly called Talken to verify what had happened.

“I was like, ‘I have no idea what you’re talking about…and by the way, you’ve passed the test. Thank you for calling me,’” Talken said. He said only a few employees clicked on the faux-malicious link in the email, though single sign-on blocked any further havoc. None of the employees gave up their credentials, and client data was never at risk during the exercise.

Looking back, Talken said the experience was “eye-opening” for his company and caused Albert Invent to “accelerate” internal changes to its system authentication.

“Everyone was secure, but it got close, and that is what we were looking for. Maybe more than anything else, it brought a heightened sense of awareness to our entire company of what is possible today.”

Two men in front of computers over purple background.

Why a science tech startup performed an offensive raid on its employees

Albert Invent CEO Nick Talken tells IT Brew the hack carried out by a cybersecurity firm was “eye-opening.”

The Department of Education was subject to a phishing campaign that targeted the agency’s G5 portal, which handles its grant management system.

BforeAI, a company that provides predictive intelligence for attacks and digital risk protections, identified the campaign on July 15 according to 

 released by the company. The cybersecurity group found that there were “multiple lookalike domains” that were attempting to spoof the G5 login page to harvest login credentials.

Lead researcher at BforeAI Abu Qureshi told IT Brew that the company was tracking the bad actor that had been targeting insurance and HR agencies in the US, but pivoted to ED as the group started doing work to take the campaign down. Qureshi said that the phishing attempt is “very timely” with the recent layoffs from the agency.

“It’s not uncommon for actors to try and exploit these reductions in force in big companies or layoffs in [the] public sector as well, especially because the view from the attacker perspective is that public sector is not very well staffed internally to begin with for cybersecurity,” Qureshi said.

Qureshi said that currently, the victim tally is unknown and is not something they are tracking, but “the infrastructure is still live and it was live for some time…there’s a chance that there have been victims.”

These could be the same actors that BforeAI found were sending fraudulent texts to users accused of having unpaid toll fees, according to Qureshi. These actors were found to “be almost operated exclusively out of China.”

“We haven’t been able to connect the dots yet, but it’s possible,” Qureshi said. “The amount of time this has been live leads me to believe that it likely is one of those geographies that don’t cooperate with the US or even companies based in the West.”

He continued: “This is a common problem we face on the…internet mitigation, abuse mitigation side, which is dealing with unfriendly nations and dealing with operators within those unfriendly nations. Because sometimes it has to get to the level where the US government gets involved and outreach to that government—and then they kick in the door, quite literally at some point, because they will not take this down.”

The department did not respond to BforeAI’s report that the company sent through its Office of Inspector General, according to Qureshi.

ED now has a message populated on the G5 portal stating the phishing campaign “intended to steal login credentials to access grant award data and change payment instructions.” The agency advised users to type in G5’s URL directly instead of clicking links from any email.

The Cybersecurity and Infrastructure Security Agency did not respond to a request for comment in time for publication.