Field notes from Common Defense on social engineering, communication-channel attacks, and the defenses we build to stop them.
Scammers now reach people on every channel they use for work: email, voice, text, WhatsApp, and Telegram. Nearly every major breach starts the same way, with a message or call that looks legitimate on a channel the company already trusts. Here's how it happens, and what we built to stop it.
Read article →
2 million scanned messages and 48,900 threats detected, and the monthly count shows the growth curve behind the total, not just the milestone.
Huntress investigated five suspected DPRK remote workers in 2026, at healthcare and financial-services employers, in sales and medical roles as well as IT. Fraudulent remote employment is an identity-and-access problem that starts at hiring, and the evidence to catch it sits in systems that do not share a queue.
A step-by-step incident response guide for the first 24 hours: contain the breach, preserve evidence, communicate without panic, and recover. Includes the AI-native threat angle most playbooks miss.
The safest place to keep Bitcoin was supposed to be a device that never touches the internet. Over five days, attackers drained more than $100M from those devices without physically touching a single one. Here's what went wrong, and why it started five years before anyone lost a coin.
Application security asks whether the code is correct. For most of the last three years, the losses answered a different question.
In March 2026, attackers took over the npm account behind axios, a JavaScript library that's pulled around 100 million times a week. Every step looked legitimate, right up until a prompt in a meeting asked the maintainer to install an update. Here's how it happened.
