|
By KnowBe4 Team
Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.
|
By KnowBe4 Team
Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters. “Attackers overwhelmingly targeted users and their unmanaged devices to gain access to accounts,” the researchers write.
The digital landscape faces a new and complex challenge: the rise of generative AI. While these tools offer incredible potential for innovation, they also provide malicious actors with sophisticated ways to deceive even the most vigilant users.
The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust
|
By KnowBe4 Threat Lab
A legitimate sender does not mean legitimate content. Attackers have abused legitimate services such as DocuSign, SharePoint, Adobe Sign, Dropbox and Google Drive to exploit that trust for years. KnowBe4's Phishing Threat Trends Report Vol. 7, released April 2026, flagged this shift at the industry level: 22% of all phishing attacks are now sent through a legitimate platform, with attackers moving from impersonating a brand to abusing that brand's actual infrastructure.
|
By Nick Gasse
Somewhere in your security and compliance stack, there are records that prove your employees completed their security awareness training. But when these records need to serve as evidence, would they actually hold up to scrutiny? For many companies, the answer is no, and that’s becoming a major risk. Following steadily rising claims over the years, insurers have narrowed their coverage definitions and requiring stricter adherence to security standards.
|
By KnowBe4 Team
Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally. The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact. The attack takes place as follows.
|
By Nick Gasse
At any given moment, there’s an employee somewhere in the world tuning out of a phishing training module that was translated from another language. Every word is rendered correctly, yet the learner still stops paying attention. In these situations, the translation often gets the blame for not engaging the learner, but the real culprit is design.
|
By KnowBe4 Threat Lab
As millions of shoppers prepare their wishlists and await discounts for Amazon’s Prime Big Deal Days starting October 6, cybercriminals are gearing up for their own payday. In the weeks leading up to major shopping events, Amazon impersonation campaigns reach an annual peak.
|
By KnowBe4 Team
Researchers at Netskope are tracking a phishing kit that hijacks users’ browser windows to display fake security alerts. The malicious websites are distributed via Google Ads, and pose as normal online stores. Once a user clicks a link on the page, however, the site will present them with an urgent-looking security warning.
|
By Erich Kron
Spies have always relied on technology, disguises, secret communications and clever gadgets, at least if the movies are to be believed. But some of the most effective tools in the espionage business have always been people. Convince the right person to open a door, reveal a secret or trust someone they should not, and suddenly bypassing the sophisticated security system becomes unnecessary.
Hackers scan the internet for smart home devices running factory-default passwords like "admin." Once inside, they jump to your personal devices on the same Wi-Fi network!
AI-generated scams eliminate obvious red flags like bad grammar and broken English, making digital fraud nearly impossible to spot at a glance. Learn how to pause, evaluate artificial urgency and verify suspicious requests before clicking or transferring money!
Deepfakes are taking over social feeds, and nearly 70% are almost impossible to detect with the naked eye. Learn the quick behavioral habits that will stop you from falling for AI-generated scam media and misinformation online!
The Sack Company implemented KnowBe4 to eliminate "click happy" employee behavior and streamline phishing campaign management across its family of companies. By leveraging KnowBe4’s AI Defense Agents (AIDA) and gamified phishing security awareness training, The Sack Company reduced organizational risk scores while saving 50 to 60 hours per week in IT monitoring time. KEY HIGHLIGHTS & RESULTS: TIMESTAMPS / CHAPTERS.
Overrated and underrated AI hot takes.
Still forcing yourself to remember random passwords? Dr. Martin Kraemer shares a memory-based formula to craft secure, super-memorable passphrases.
When high-stakes attackers target you, they aren't playing the cards — they’re playing the player. For National Social Engineering Day, Erich Kron reveals modern social engineering's biggest tell.
AI tools state false information with just as much credibility as the truth. Here’s what you need to know about AI hallucinations.
More summer screen time means more opportunities for gaming scammers. Watch out for fake "Free Robux" scams targeting kids online, and learn the easy red flags to teach your family today.
What is the single best piece of security advice? Pausing.
|
By KnowBe4
Want to read this bestseller? Register now for your free (instant 240-page PDF download) Cyberheist e-book and learn how to not be the next victim! Cyberheist was fully updated and written for the IT team and owners / management of Small and Medium Enterprise, which includes non-profits, local and state government, churches, and any other organization with more than a few thousand dollars in their bank operating account.
|
By KnowBe4
Your employees are your largest attack surface. For too long the human component of cybersecurity has been neglected, leaving employees vulnerable and creating an easy target for cybercriminals to exploit. But your users want to do the right thing. Rather than a hurdle to be overcome, organizations need to think of their employee base as an asset, once properly equipped.
|
By KnowBe4
Spear phishing emails remain a top attack vector for cybercriminals, yet most companies still don't have an effective strategy to stop them. This enormous security gap leaves you open to business email compromise, session hijacking, ransomware and more. Don't get caught in a phishing net! Learn how to avoid having your end users take the bait. Roger Grimes, KnowBe4's Data-Driven Defense Evangelist, will cover techniques you can implement now to minimize cybersecurity risk due to phishing and social engineering attacks.
|
By KnowBe4
Hackers have become increasingly savvy at launching specialized attacks that target your users by tapping into their fears, hopes, and biases to get access to their data. Cybersecurity is not just a technological challenge, but increasingly a social and behavioral one. People, no matter their tech savviness, are often duped by social engineer scams, like CEO fraud, because of their familiarity and immediacy factors.
|
By KnowBe4
Anything but 100% completion on your employee compliance training is often more than simply frustrating. Compliance audits and regulatory requirements can make anything less than 100% feel like a failure. But, getting compliance on your compliance training is possible! Organizations have struggled for years with getting everyone to complete their required compliance training. This puts organizations at risk of more incidents occurring, fines or reputational damage if an employee is non-compliant.
|
By KnowBe4
All multi-factor authentication (MFA) mechanisms can be compromised, and in some cases, it's as simple as sending a traditional phishing email. Want to know how to defend against MFA hacks? This eBook covers over a dozen different ways to hack various types of MFA and how to defend against those attacks.
- October 2026 (11)
- September 2026 (31)
- August 2026 (37)
- July 2026 (38)
- June 2026 (39)
- May 2026 (39)
- April 2026 (28)
- March 2026 (50)
- February 2026 (26)
- January 2026 (22)
- December 2025 (31)
- November 2025 (31)
- October 2025 (42)
- September 2025 (26)
- August 2025 (24)
- July 2025 (17)
- June 2025 (26)
- May 2025 (24)
- April 2025 (31)
- March 2025 (31)
- February 2025 (24)
- January 2025 (24)
- December 2024 (21)
- November 2024 (29)
- October 2024 (37)
- September 2024 (27)
- August 2024 (33)
- July 2024 (41)
- June 2024 (32)
- May 2024 (38)
- April 2024 (34)
- March 2024 (38)
- February 2024 (42)
- January 2024 (46)
- December 2023 (41)
- November 2023 (33)
- October 2023 (45)
- September 2023 (49)
- August 2023 (49)
- July 2023 (42)
- June 2023 (45)
- May 2023 (48)
- April 2023 (44)
- March 2023 (14)
- February 2023 (3)
- January 2023 (4)
- December 2022 (3)
KnowBe4 is the provider of the world's largest integrated platform for security awareness training combined with simulated phishing attacks. Join our more than 56,000 customers to manage the continuing problem of social engineering.
The KnowBe4 platform is user-friendly and intuitive, and powerful. It was built to scale for busy IT pros that have 16 other fires to put out. Our goal was to design a full-featured, yet easy-to-use platform.
Find Out How Effective Our Security Awareness Training Is:
- Train Your Users: The world’s largest library of security awareness training content. Automated training campaigns with scheduled reminder emails.
- Phish Your Users: Best-in-class, fully automated simulated phishing attacks, thousands of templates with unlimited usage, and community phishing templates.
- See The Results: Enterprise-strength reporting, showing stats and graphs for both training and phishing, ready for management. Show the great ROI!
Human Error. Conquered.