Arsen Security Blog

Recent CISO surveys point to a more complex threat landscape: AI is accelerating attacks and amplifying risk, even as it offers powerful defensive capabilities when used effectively. At the same...

MITRE Fight Fraud Framework (F3): What It Is and Why It Matters

The MITRE Fight Fraud Framework (F3) is a structured, analyst-built knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents....

Why Vishing Has Become the Main Cyber Threat, And What to Do About It

Vishing has overtaken email phishing as the go-to attack vector for threat actors in 2025. Google and Mandiant's M-Trends 2026 report confirms voice phishing hit #2 across all breaches. Here's...

Why Basic Phishing Training Won't Stop AI Social Engineering

Annual phishing training built around spotting typos and suspicious sender addresses doesn't address AI-enabled social engineering. In 2025, 83% of phishing emails were AI-generated with flawless...

AI Vishing: Why Finance Teams Are the New Front Line

AI voice cloning has collapsed the cost of vishing from hundreds of dollars per targeted call to effectively zero at scale. Finance, treasury, and executive assistant teams now face the same...

Deepfake Fraud in Financial Services: What CISOs Need to Do Now

Deepfake fraud is now an active loss event for financial institutions. Over $200 million in financial losses were attributed to deepfake fraud in Q1 2025 alone (Resemble AI), and 44% of financial...

VENOM: Inside a C-Suite Credential Theft Campaign That Neutralizes MFA

Abnormal Intelligence documented VENOM, a previously unknown PhaaS platform behind a five-month campaign targeting C-suite executives across 20+ industries, systematically bypassing MFA to...

From a CEO Impersonation, a Slack Lure to a Full-On Compromise: The Axios & UNC1069 Case

The recent Axios npm supply chain attack, attributed to UNC1069 (suspected North Korean actors), was not a technical exploit. It was a meticulously crafted social engineering campaign. From a...

Google Safe Browsing: How to Recover from a Domain Flagging

Sec Ops

Phishing simulation domains can get flagged by Google Safe Browsing even when used for legitimate security testing. Here's how to recover flagged domains fast and keep your awareness campaigns...

Google Safe Browsing: How to Stay Invisible to Google's Bots

Sec Ops

Google Safe Browsing protects billions of devices — but it can disrupt authorized phishing simulations. Discover multi-layered anti-crawling strategies including IP filtering, CAPTCHA, time-based...

Google Safe Browsing: How Does It Work?

Sec Ops

Google Safe Browsing protects billions of users from malicious websites and phishing threats. But for organizations running internal phishing simulations, it creates real technical hurdles....

How to Defend Against Advanced Smishing Attacks (and Why Basic Training Isn't Enough Anymore)

Smishing has moved well beyond a fraudulent text. From MitM OTP hijacking to cross-channel escalation, here's how sophisticated SMS-based attacks work, and what it takes to stop them.

ClickFix Attacks: How Hackers Make Your Employees Run Malware Themselves

ClickFix is one of the fastest-growing social engineering attack techniques. It needs no exploit, no malicious attachment, just a fake error message and a willing user. Here is what happened, why...

AI-Enhanced Vishing in Financial Services: How Voice Cloning Is Outpacing Your Defenses

AI voice cloning has turned vishing into a scalable, high-precision weapon against financial institutions. A Canadian insurer lost $12M after an AI-cloned executive voice authorized fraudulent...

Supply Chain Attacks in Financial Services: Why Your Vendors Are Becoming Your Biggest Vulnerability

Your perimeter controls mean nothing if an attacker compromises a trusted vendor first. The SitusAMC breach in November 2025 exposed data across 100+ financial institutions without touching a...

Deepfake Video Impersonation: The Threat Financial Institutions Can No Longer Ignore

Deepfake video impersonation has crossed from theoretical risk to documented loss. The 2024 Arup attack cost $25 million after a finance employee was deceived by a live AI-generated video call....

The Financial Services CISOs White Paper: Navigating Cyber & AI Regulations in 2026

AI regulation is accelerating fast. From DORA to the EU AI Act, financial services CISOs face a tightening compliance landscape in 2026. Arsen breaks down what may change, what is at stake, and...

AI-Powered Social Engineering in Financial Services: What Every CISO Needs to Know in 2026

AI-powered social engineering is reshaping the threat landscape for banks, insurers, and fintechs. This guide gives financial services CISOs the frameworks, checklists, and strategic intelligence...

Microsoft Entra Users: Be Careful, You Might Be the Target of a New Vishing Campaign

ShinyHunters are exploiting a legitimate Microsoft OAuth feature to compromise Entra accounts. No fake login page, no stolen password. One convincing vishing phone call is all it takes to hand...

Figure Data Breach: Social Engineering Actors Are Preying on Fintechs, but It’s Not a Fatality

Blockchain lending firm Figure confirmed a significant data breach resulting from a social engineering attack on an employee, leading to the leak of customer data and highlighting the persistent...

The Era of "Dark LLMs": How AI is Supercharging Social Engineering

7 months ago

The AI revolution of the 2020s has positioned Large Language Models (LLMs) as the new foundation for digital transformation. With unparalleled data processing power and text comprehension, LLMs...

How Sophisticated Vishing Attacks are Currently Bypassing SSO for Wide-Scale SaaS Data Theft

7 months ago

The ShinyHunters group is currently orchestrating vishing attacks and exploiting SSO to bypass multi-factor authentication. These sophisticated campaigns have led to breaches of cloud platforms...

The New Vishing Playbook: Attackers Can now Control the Flow in Real-Time and Break SSO

7 months ago

Identity attacks are evolving into hybrid vishing operations. New phishing kits allow attackers to manipulate a victim’s browser in real-time, syncing web visuals with phone scripts to perfectly...

New in Arsen: Turn a Simple Prompt into a Comprehensive Defense Strategy

Product

Our latest release note: Building effective cybersecurity training takes time. Arsen’s new AI-assisted builder combines hyper-realistic simulations with customizable learning paths that blue teams...

How Quishing Can Be Weaponized to Target Top Organizations: The North Korea’s Kimsuky Case

The FBI warns that North Korean group Kimsuky is using quishing to target organizations. Discover how bad actors exploit QR codes to bypass security controls and how to test your defense against...

The InboxPrime Case: AI-Based Phishing Kits, Or The New Frontier of Credential Theft

AI and LLMs are creating a paradigm shift in cyberattacks. Attackers now use AI-powered kits to automate the entire attack lifecycle with unprecedented speed and precision. CISOs must adapt...

The BlackForce MitM Phishing Kit & MFA Hijacking: When Your Credentials Are No Longer Enough

Phishing has evolved. Zscaler ThreatLabz recently revealed BlackForce, a toolkit hijacking active sessions and bypassing MFA, using the "Man-in-the-Middle" (MITM ) attack tactic. CISOs must update...

Vishing Training Platforms for Call Center Teams

Call centers are prime targets for voice phishing due to high-pressure environments and shared access. Discover why specialized vishing training platforms are essential for BPOs to defend against...

Vishing Training for Financial Services Teams

Protect your financial institution from voice phishing. Learn why vishing targets banking and fintech teams, the limitations of traditional defenses, and how to implement scalable, compliant...

Vishing And The "Quick Assist" Trap: How Attackers Weaponized A Trusted Microsoft Tool

9 months ago

A new vishing campaign weaponizing Microsoft Teams and Quick Assist for fileless malware execution was recently revealed. Learn how this hybrid attack bypasses defenses and why AI-driven vishing...

How Hundreds of Financial Institutions Were Hit by Massive Phishing and How to Prevent It

9 months ago

A recent massive phishing campaign targeted financial institutions by weaponizing trusted services like Mimecast and DocuSign. Discover how these attacks bypass filters and learn how to protect...

Vishing vs Phishing in Cybersecurity Awareness Programs

Email phishing is still the #1 entry point for social engineering, but attackers no longer stop at the inbox. They follow up with phone calls, pressure employees in real time, and stitch channels...

AI Voice Phishing Simulations: Legal Considerations

Vishing simulations are a powerful awareness tool — but without legal guardrails, they can put your organization at risk. Here’s how to approach them safely.

Cybersecurity Awareness Training and FERPA: Securing Student Records Through Education

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records in the United States. While FERPA places legal obligations on schools, universities, and...

How Cybersecurity Awareness Training Supports the NIST Cybersecurity Framework

The NIST Cybersecurity Framework (CSF) is a widely adopted set of best practices for managing cybersecurity risks across all sectors — from critical infrastructure to cloud-native startups. It...

Cybersecurity Awareness Training for CCPA / CPRA Compliance: Empowering Employees to Protect Consumer Privacy

The California Consumer Privacy Act (CCPA) and its expanded version, the California Privacy Rights Act (CPRA), have redefined how businesses must handle personal data in the U.S. These laws...

PCI-DSS and Cybersecurity Awareness Training: Protecting Cardholder Data from Human Risk

The Payment Card Industry Data Security Standard (PCI-DSS) is a mandatory framework for any organization that stores, processes, or transmits cardholder data. While most PCI compliance efforts...

HIPAA Compliance and Cybersecurity Awareness: Training for Healthcare Data Protection

The Health Insurance Portability and Accountability Act (HIPAA) mandates the protection of Protected Health Information (PHI) across healthcare providers, insurers, and business associates. While...

Cybersecurity Awareness Training and NIS2 Compliance: Securing the Human Layer in Critical Sectors

The NIS2 Directive (Directive (EU) 2022/2555) represents a significant expansion of the EU’s cybersecurity legislation, aimed at strengthening resilience across critical infrastructure and digital...

Cybersecurity Awareness Training for DORA Compliance: Managing Human Risk in Financial Services

The Digital Operational Resilience Act (DORA) is the European Union’s new regulatory framework aimed at strengthening the operational resilience of financial services — including banks, fintechs,...

Cybersecurity Awareness Training and ISO 27001: A Practical Compliance Guide

ISO/IEC 27001 is one of the most widely recognized standards for Information Security Management Systems (ISMS). Whether you're pursuing certification or maintaining compliance, one thing is...

Meeting SOC 2 Type II Requirements with CSAT

SOC 2 Type II has become the gold standard for demonstrating security and trustworthiness in the SaaS and technology sectors. Unlike Type I, which evaluates controls at a point in time, Type II...

How Cybersecurity Awareness Training Supports GDPR Compliance

Since the introduction of the General Data Protection Regulation (GDPR) in 2018, organizations operating in or serving the EU have faced strict requirements for how they handle personal data....

Modern Phishing Detection: Why It’s So Hard and How to Get Better at It

Modern phishing detection is notoriously difficult. As technology evolves, so do attack patterns. What was once a simple scam exploiting an emotional lapse has become a sophisticated,...

MFA Fatigue: The Growing Threat Undermining Multi-Factor Authentication

Multi-factor authentication (MFA) was supposed to be the silver bullet. By requiring a second step—typically a push notification or a one-time code—organizations could drastically reduce the risk...

Quishing: The Rise and Dangers of QR Code Phishing

Quishing — short for QR code phishing — is a rapidly growing threat vector that blends physical simplicity with digital deception. While many organizations have matured their defenses against...

QR Code Phishing: The Complete Protection Guide

QR code phishing, sometimes called “quishing,” is a rising threat that cleverly blends the digital and physical worlds. Attackers embed malicious URLs inside QR codes, hoping victims will scan...

AI Vishing Attack: analysis of a new threat

"The voice sounds real. The request seems urgent. But the person on the line doesn’t exist." AI is transforming vishing into something faster, more convincing—and terrifyingly scalable. With...

Vishing Awareness Training: train your employees against vishing

"Your employees might know about vishing—but will they recognize it when it strikes?" Awareness isn’t enough. In today’s threat landscape, attackers exploit emotion, pressure, and live...

Callback vishing: when phishing leads to vishing

"Think you're safe because you made the call? Think again." Callback vishing flips the script—literally. Instead of the hacker calling you, you unknowingly call them. Blending the deceptive power...

Voice cloning attacks: all you need to know

"Can you trust the voice on the other end of the line?" With AI-powered voice cloning now accessible to anyone with an internet connection, this chilling question is no longer theoretical. From...

The Slovakia Election Deepfake: AI’s Threat to Democracy

In 2023, Slovakia became a cautionary tale when a fake audio recording targeting a prominent candidate in its national election sparked widespread outrage and concerns about electoral fraud....

The Le Drian Scam: A Masterclass in Social Engineering

Social engineering, the art of manipulating individuals to divulge confidential information or perform actions that compromise security, has evolved dramatically in recent years. But before...

Social Engineering Attacks: Tactics and Defenses

In this article we’ll explore how people’s emotions become business vulnerabilities, why social engineering is so effective, and three powerful principles to secure and protect your environment.

Social Engineering Examples: Real-World Tactics

How can you protect your organization from social engineering attacks and their adverse impacts? This article explores different attack strategies, real-world examples, and prevention methods.

How to Run a Simulated Vishing Attack? Our complete guide.

"How would your team respond to a voice phishing attack—right now?" In today’s threat landscape, knowing isn’t enough. Simulated vishing attacks are the safest way to uncover how employees...

Bypassing Multi Factor Authentication (MFA) with a callbot

Call bots, a kind of vishing automation can be used to trick victims and defeat MFA. Here's how.

Domain Doppelgängers: Protecting Against Domain Spoofing

Cybersecurity threats continue to evolve, and one of the rising concerns for businesses is the domain doppelganger. These deceptive domains are crafted to mimic legitimate websites, luring...

AIDS Trojan Analysis: Early Malware Case Study

The AIDS Trojan, also known as the AIDS Information Diskette Trojan, is widely recognized as one of the earliest examples of ransomware* Its appearance in 1989 shocked the nascent world of...

Remote Access Trojan: What It Is & How to Detect It

Remote Access Trojans (RATs) are a dangerous form of malware that allows cybercriminals to gain unauthorized access and control over an infected computer or network. Understanding the risks posed...

Ransomware Simulator: Testing Your Defenses

In today's cybersecurity landscape, ransomware remains a top threat to organizations of all sizes. A ransomware attack can lock down your systems, encrypt your data, and demand a hefty ransom for...

Locky Ransomware Explained: Protection Strategies

Locky ransomware is a notorious form of malware that emerged in 2016, targeting businesses and individuals alike. This sophisticated ransomware spreads primarily through malicious email...

What Is Bad Rabbit Ransomware? How It Works & How to Stop It

In the world of cybersecurity, Bad Rabbit ransomware has made headlines as one of the more sophisticated and dangerous ransomware attacks. This malware first surfaced in 2017, targeting companies...

WannaCry Ransomware Attack: A Case Study

The WannaCry ransomware attack, which occurred in May 2017, stands as one of the most significant and destructive cyberattacks in recent history. It serves as a critical lesson for organizations...

Ransomware Definition: What is it & How to Secure your Data?

Ransomware is one of the most prominent cyber threats today, targeting both individuals and organizations alike. In this article, we will dive into the ransomware definition, how it works, and the...

Ransomware Attacks: Effective Defense Strategies

Ransomware attacks have rapidly become one of the most disruptive forms of cybercrime, targeting businesses of all sizes. By encrypting valuable data and demanding a ransom for its release, these...

Cybersecurity Regulatory Compliance — Key Strategies for CISOs

In today's digital age, regulatory compliance is a critical aspect of running a successful business. Ensuring that your company adheres to applicable laws and regulations helps avoid legal...

Compliance Risk: Identification and Mitigation

In today's highly regulated business landscape, compliance risk is a critical concern for organizations across industries. Failing to comply with laws and regulations can result in severe...

Compliance Monitoring: Ensuring Policy Adherence

Effective compliance monitoring is critical for ensuring that organizations consistently adhere to internal policies and regulatory requirements. As companies face increasing scrutiny from...

Compliance Management: Effective Strategies

Effective compliance management is essential for organizations to meet legal obligations, protect their reputation, and maintain operational integrity. As regulations evolve, businesses must adopt...

CCPA (California Consumer Privacy Act) Compliance: Complete 2024 Guide

The California Consumer Privacy Act (CCPA) is a pivotal data privacy law that grants consumers more control over their personal information. For businesses operating in or interacting with...

IT Compliance: Navigating Regulations in Tech

In today’s rapidly evolving tech landscape, **IT compliance** plays a critical role in ensuring organizations meet legal and regulatory requirements. Failure to comply can lead to severe...

What Is a VPN? How It Works & Why You Need One

In today's increasingly digital world, safeguarding online privacy has become more crucial than ever. One of the most effective ways to protect your personal information while browsing the web is...

What Does VPN Stand For? Understanding Its Use

In today’s interconnected world, ensuring your online privacy and security is more crucial than ever. One of the most effective tools for safeguarding your digital presence is a **VPN**. But what...

VPN Definition: Virtual Private Networks Best Practices

A VPN (Virtual Private Network) is a tool that enhances your online security by encrypting your internet connection and masking your IP address. This makes it an essential part of modern digital...

Examples of Data Breaches and Lessons Learned

Data breaches have become a persistent threat to organizations of all sizes. By analyzing data breaches examples, we can uncover key lessons for safeguarding sensitive information. Below are some...

Data Breach Response and Prevention Strategies

In today’s digital landscape, data breaches are a constant threat. Companies of all sizes are vulnerable to these attacks, making it crucial to adopt effective prevention and response strategies....

How Do People Get Doxxed? | Risks and Prevention Tips

Doxxing, short for “document tracing,” refers to the act of publicly disclosing someone’s personal information, like their real name, home address, phone number, or even financial data, without...

Pretexting Definition: The Art of Deceptive Information Gathering

Pretexting is a social engineering tactic that involves creating a fabricated scenario to deceive an individual into disclosing sensitive information. Unlike other forms of cyberattacks,...

What is Pretexting? | Understanding Social Engineering

Pretexting is a sophisticated social engineering technique used by cybercriminals to manipulate individuals into divulging sensitive information. But what is pretexting exactly, and how does it...

SSTP: Secure Socket Tunneling Protocol Explained

The Secure Socket Tunneling Protocol (SSTP) is an important player in ensuring secure and private communication over the internet. Often used in Virtual Private Networks (VPNs), SSTP provides a...

DNS Security: Best Practices to Protect Your Network

In today's digital landscape, DNS security is a crucial aspect of safeguarding any organization’s network. The Domain Name System (DNS) acts like the internet’s phonebook, translating domain names...

SMTP Relay: Facilitating Efficient Email Delivery

In the world of email communications, SMTP relay plays a critical role in ensuring that emails are delivered efficiently across networks. Whether you're a business sending newsletters or...

Sendmail: Configuring Email Servers for Security

Sendmail is a widely-used mail transfer agent (MTA) that handles the delivery of email across networks. It’s been a cornerstone of email server infrastructure for decades, primarily on Unix-based...

Typosquatting: How Misspellings Can Lead to Fraud

Typosquatting, also known as URL hijacking, is a form of cyberattack that exploits common typing mistakes made by users when entering website addresses. A single misspelling can redirect users to...

Social Engineering Definition: Cybersecurity Best Practices

Social engineering is a technique used by cybercriminals to manipulate individuals into revealing confidential information or performing actions that compromise security. Rather than hacking...

PII Meaning — What It Is & How to Protect Personal Data

In today's digital world, the term "PII" (Personally Identifiable Information) has become central to discussions around cybersecurity and privacy. But what exactly is PII, and why is it so...

Watering Hole Attack: What It Is & How to Prevent It

Watering hole attacks are an increasingly sophisticated cyber threat, targeting specific groups or organizations by compromising websites they frequently visit. In this article, we will break down...

DNS Meaning: What Does DNS Stand For?

When exploring the complex world of the internet, the term "DNS" frequently pops up. But what does DNS stand for, and why is it important? This article will break down the DNS meaning and explain...

What is Doxxing? | Understanding Online Exposure

In today’s digital age, personal information is more accessible than ever, and this has given rise to a dangerous practice known as doxxing. But what is doxing? Simply put, doxxing (also spelled...

PII (Personal Identifiable Information): How to Protect Your Privacy?

In today’s digital age, Personal Identifiable Information (PII) is more vulnerable than ever. With cybercriminals targeting sensitive data to commit identity theft or fraud, safeguarding your PII...

Which Type of Phishing Simulation Should You Choose?

Phishing comes in different shapes and forms. This means you have a lot of choices when it comes to creating a phishing simulation, and most companies get confused as to what type of simulation...

How to launch a phishing simulation to better protect your company?

In this post, we'll explore the key steps to launch a phishing simulation that will help you protect your company from phishing attacks.

Employee Phishing Training — Empower Your Workforce Against Attacks

Phishing training for employees is essential in building defense skills against cyberattacks. By educating employees on how to recognize and respond to phishing attempts, businesses can reduce the...

Phishing Training — Build Employee Awareness & Resilience

Phishing training is essential for protecting your organization from cyberattacks. By educating employees on how to recognize and respond to phishing threats, you can reduce the risk of data...

Build Phishing Awareness & Protect Your Organisation

Phishing awareness is essential to safeguarding your business from cyberattacks. Learn how to recognize phishing attempts, understand common tactics used by attackers, and implement strategies to...

Quishing: When Phishing Meets QR Codes

Quishing is a new phishing tactic where attackers use malicious QR codes to deceive users into visiting fraudulent websites or downloading harmful software. Learn how quishing works, real-world...

DMARC Explained: Securing Email Integrity

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that helps prevent spoofing and phishing attacks. It allows domain owners to define how...

DMARC Checker: Validate Your Email Protection

Ensure your email domain is protected from spoofing with Arsen's free DMARC Checker. Validate your DMARC setup, verify SPF and DKIM alignment, and safeguard your emails against cyber threats....

What is DKIM? Understanding Email Authentication

DKIM (DomainKeys Identified Mail) is an email authentication method that verifies the sender's identity and ensures message integrity. By adding a digital signature to emails, DKIM helps protect...

DKIM Checker: Verify Email Security

Ensure your emails are protected from spoofing and tampering with Arsen's free DKIM Checker. Easily verify your email's DKIM setup and secure your communications from potential cyber threats....

What Is a Common Indicator of a Phishing Attempt?

Identifying common indicators of a phishing attempt is crucial for staying secure online. Look out for suspicious sender addresses, generic greetings, urgent language, unusual links, and requests...

Phishing Attack Types Every CISO Should Know

Phishing attacks come in various forms, from deceptive emails to fraudulent text messages. Understanding the types of phishing—including email phishing, spear phishing, smishing, vishing, and...

Understanding Spear Phishing: Focused Cyber Attacks

Spear phishing is a targeted cyberattack that uses tailored information to trick individuals or companies into revealing sensitive data. Learn what spear phishing is and discover key prevention...

What Is Spear Phishing? Definition & Defense Tips for CISOs

Spear phishing is a targeted form of phishing that uses personalized tactics to deceive specific individuals or organizations. Unlike regular phishing, spear phishing exploits trust by mimicking...

Spam vs Phishing — Key Differences & How to Stay Protected

Spam and phishing are common types of unwanted emails, but they serve different purposes and pose different risks. While spam typically promotes products or services, phishing aims to steal...

Smishing vs Phishing: What Cybersecurity Pros Must Know

Smishing and phishing are cyber threats that use deception to steal personal information. While phishing typically targets victims through email, smishing uses text messages to trick individuals...

Examples of Phishing Emails and Prevention Tips

Phishing emails are crafted to deceive and steal sensitive information. Understanding various phishing email examples, such as fake security alerts, unexpected invoices, and prize notifications,...

How to Identify a Phishing Email & Protect Your Organisation

Phishing emails use deceptive tactics to trick you into revealing sensitive information. Learning to identify phishing email techniques, such as manipulated sender addresses, urgency tactics, and...

Phishing Detection: Tools and Techniques

Phishing detection is essential to prevent cyberattacks that trick individuals into revealing sensitive information. Combining advanced tools like email filters, web filtering, and anti-phishing...

How to Spot a Phishing Email: Key Indicators

Phishing emails are a favorite tool of cybercriminals, designed to steal sensitive information. Knowing how to spot a phishing email is key to staying protected. Look out for unusual email...

Facebook Phishing: Protecting Your Profile

Facebook phishing is a common scam where attackers attempt to steal your login credentials and personal information. By recognizing tactics like fake login pages, malicious links, and...

Phishing Email Examples: Spotting the Signs

Phishing emails often disguise themselves as legitimate communications to trick you into revealing sensitive information. Recognizing an example of phishing email is crucial for protecting your...

TOP 5 Common Indicators of a Phishing Attempt

Phishing attempts are designed to trick you into revealing sensitive information. Recognizing the common indicators of a phishing attempt is essential for online security. From suspicious sender...

Clone Phishing: Recognize and Avoid

Clone phishing is a deceptive cyberattack where legitimate emails are replicated with malicious intent. Attackers use nearly identical copies of trusted communications but replace links or...

Check Phishing Link: How to Verify Safe URLs

Phishing attacks often involve malicious links disguised as legitimate URLs. Knowing how to check phishing links is essential for your online security. Be cautious with suspicious URLs, hover over...

Vishing Definition & How to Stop Voice Phishing Attacks

Vishing, or voice phishing, is a phone scam where attackers use various techniques, such as caller ID spoofing and urgency tactics, to trick victims into revealing sensitive information....

What is Vishing? | Protecting Against Phone Scams

Vishing is a form of voice phishing where attackers use phone calls to trick individuals into revealing sensitive information. Unlike traditional email-based phishing, vishing exploits the trust...

What is Catfishing? | Identifying Online Deception

Catfishing is a form of online deception where individuals create fake identities to manipulate others. Learning how to identify catfishing is essential to protect yourself from these scams. This...

Catfishing meaning: Definition & Examples

Catfishing is a form of online deception where someone creates a fake identity to lure others into fraudulent relationships. This practice can involve emotional manipulation, financial scams, or...

What is Spoofing? | Cybersecurity Risks

Spoofing is a deceptive cyberattack where criminals disguise themselves as trusted sources to steal sensitive information or spread malware. One of the most prevalent forms is email spoofing,...

Spoofing Definition: What It Is & How to Prevent Email Attacks

Email spoofing is a deceptive cyberattack where hackers forge an email's sender address to appear as though it's from a trusted source. This tactic is often used in phishing schemes, business...

How to Prevent Spoofing: Strategies & Best Practices

Email spoofing is a dangerous cyber threat that can compromise your organization’s security and reputation. Attackers disguise their emails to appear as though they come from a trusted source,...

AI Attacks — How Artificial Intelligence Is Changing Cyber Threats

Conference on the Impact of AI on Cyberattacks in 2024.

Phishing & AI: new attacks and new solutions

In this discussion with Benjamin Leroux from Advens, we explore the changes brought by generative AI to the attack landscape when it comes to phishing and social engineering.

Malicious Attachment generation with generative AI

Spreading malware or gaining initial access through email attachment is the third most common phishing tactic. Because of the scale of our phishing operations at Arsen, we wanted to explore the...

Generative AI Phishing Scenarios

GenAI phishing is now a thing. You might want to deploy it for your clients or your company but you might also want some scenario suggestions to get your creative juices flowing. This article is...

Using third party LLMs for genAI phishing operations

With the rise of genAI phishing, you might be tempted to use it for your phishing operations. Using a third party, well trained LLM has obvious advantages, from infrastructure cost — this GPU...

Effective generative AI for phishing engagements

If you’ve been reading our content, you’re probably itching to shoot some genAI phishing for your next simulation campaign. But one does not simply ask ChatGPT for a cool phishing email. Here...

Defense in depth: the importance of the human factor

A paradox has struck me for several years now. Everyone I speak to is convinced of the predominance of human risk. The internet is full of statistics linking initial access to employee behavior...

Alternatives to GoPhish for Comprehensive Phishing Simulations

Phishing simulation tools have become the front line of defense in cybersecurity training. By mimicking real-life phishing attempts, these tools assess human vulnerability in digital landscapes....

Use of AI in Social Engineering Attacks

From phishing to fake transfer scams, social engineering is rampant. User manipulation is responsible for a large number of cyberattacks, and the situation is not improving. Simultaneously, the...

The Multi-Scenario Campaigns

A new feature has arrived on Arsen: multi-scenario campaigns. It allows you to use multiple phishing scenarios within a single campaign. The benefit? Stay realistic by not targeting all your...

USB Drop: Discover the USB drive powered attack

An attack via USB drive, also known as USB Drop, is a danger that is still underestimated. USB drives are very effective in helping us store and transport small amounts of data. We use them...

"OVH: Domain suspension", analysis of the phishing campaign

At Arsen, we help businesses protect themselves against phishing. Part of this work involves simulating attacks on employees. We are therefore particularly attentive to real attacks that can be...

How to customize a scenario with Arsen?

In this article, we will see how to customize a phishing test with Arsen. More specifically, what elements can be included in the email to have a realistic, personalized, and more or less...

How to report a fraudulent email?

Learn how to report a fraudulent email is a crucial step in the fight against phishing. In an ideal world, everyone facing a phishing attempt would report it, as it contributes to the fight...

The cybersecurity of nomadic remote work

After seeing how to secure your remote work at home, we will now talk about mobility situations: working remotely outside. Laptops are blossoming on café terraces and it is pleasant to answer a...

Companies: How to secure teleworking

The use of teleworking has exploded and represents a major trend. This brings new challenges in terms of cybersecurity. Between the perceived improvement in quality of life for many employees and...

How to effectively raise awareness against phishing?

In this video, we explain [how to effectively raise awareness against phishing](https://arsen.co/blog/sensibiliser-efficacement-phishing). The objective of this awareness is to improve the...

What is phishing? Cyberattack's most popular initial access vector

Whether it's clicking on a malicious link or sending confidential data to a fake third party, if the threat is always external, 90% of effective cyber attacks involve an error resulting from human...

What are the results to observe during a phishing simulation?

During a phishing simulation, you will retrieve behavioral data and be able to determine your level of resilience. But what are the results to observe following a false phishing campaign and how...

Why generate a random password?

Often, when an individual needs to create a new password, they will rack their brains and choose personal information that relates to them, then modify it by changing elements or adding special...

How to properly manage your passwords

Managing identification, and more specifically passwords, is a key lever in cybersecurity. This is part of [good cybersecurity practices](/blog/personal-cybersecurity): if you have a good...

What is Juice Jacking ?

Juice jacking is a type of cyber attack that exploits USB charging cables or chargers to compromise devices with USB ports, especially mobile phones. Charging cables don't just power your phone's...

General cybersecurity recommendations for businesses

Very often during discussions with our clients, we realize that some basics of cybersecurity are not necessarily mastered. It is both common and dangerous. Cybersecurity is everyone's business...

Classification of the difficulty level of phishing

Not all phishing emails are equal. When I ask someone what they think of a "phishing email," the descriptions are very varied. Among these descriptions, the level of difficulty, that is to say,...

Click campaigns: lightweight phishing simulations to train people

Click campaigns are now available on Arsen! When you schedule a phishing campaign, it is possible to do Credential Harvesting or a click campaign. If an employee clicks on the link during a...

How to Conduct a Successful Phishing Simulation

Why conduct a fake phishing exercise? Phishing is the entry point for 91% of attacks*. The objective of phishing simulations is to prevent the hacking of your company in order to avoid financial...

Good practices of personal cybersecurity

We live in an increasingly connected world. Everyone has a phone with capabilities that surpass most computers available a few years ago, telecommuting is strengthening, most employees have a...

Defeating Multi-factor Authentication through a Simple Phishing Email

In this article, I will show you in a video how, from a simple phishing email, we can bypass multi-factor authentication, also known as MFA or 2FA."

Solutions against ransomware: how to protect, prevent and fight them

Ransomwares are becoming increasingly present on our systems. Reveton, WannaCry, Cryptolocker, REvil: if you know these names, it's because they are all ransomwares that have caused significant...

What is Cryptolocker? Presentation, infection and defence strategies

Cryptolocker is a notorious type of ransomware that has become a major threat in the world of cybersecurity. This malicious software is designed to encrypt a victim's files and demand payment,...

How often to conduct phishing simulations?

When a company adopts a new phishing simulation solution, the question often arises: "How often should I conduct phishing simulations?" The frequency of phishing simulations is a crucial...

Emotet: the malware that disrupted the private sector for 7 years.

Originally, Emotet was a banking Trojan malware. Its role was to discreetly infiltrate computers in order to steal sensitive information such as banking details. The malware carried out malicious...

Catfishing Definition: What It Is & How to Spot the Signs

In March 2021, the top 10 dating sites in France recorded 46.4 million visits, according to a study conducted by [monpetitdate](https://www.monpetitdate.fr/etude-statistiques-sites-de-rencontre/)....

WannaCry, the biggest ransomware heist in history

WannaCry is the ransomware behind one of the most significant ransomware attacks. In this article, we look back at the history of this particularly virulent ransomware.

Managing the risks tied to phishing

The risks associated with phishing are often underestimated. Many still believe that the consequences are limited to having to change a few passwords, scan their network, or even have a...

BEC Definition: Understanding Business Email Compromise

The compromise of email addresses, or Business Email Compromise (BEC), is a popular attack aimed at compromising a company's mailbox for malicious purposes. The simplest monetization is generally...

Instagram Phishing: Risks and Protection Measures

Instagram is a highly popular social network, making phishing on the platform equally prevalent. According to the "Digital Report 2021" by Hootsuite and We Are Social, Instagram ranks fifth among...

The slow but steady evolution of phishing attacks

Discover the evolution of phishing attacks over time, from the first phishing attack to the most advanced attacks occurring today.

Cybersecurity and work from home

In this article, we will focus on cybersecurity at home, or how to secure your telecommuting from home. The rules and best practices explained in this article apply to telecommuting of all kinds,...

Why are you losing money with your awareness solution?

In this article, we will discuss the limitations of different awareness solutions. The goal is not to criticize these types of solutions, but to present the missing parts so that you can either...

What to do after a phishing simulation?

It is not always easy to know the steps that follow a [phishing test](https://arsen.co/test-phishing). Many of our clients contact us initially for a phishing test and ask us what they should do...

How to Run a Phishing Test & Measure Security Awareness

In this article, we will analyze the process of a phishing test, from its setup to reporting. We will discuss framing, technical deployment, execution, and post-mortem of the exercise.

Smishing Definition & 10 Tips to Stop SMS Phishing

Did you know that SMS has an average open rate of over 95%? The definition of smishing is a digital attack through SMS that can have serious consequences. SMS marketing has become a strategy that...

Managing Campaigns as a Team.

Managing numerous phishing campaigns takes time. That's why many of our clients share the various tasks related to phishing test management or scenario design. Our awareness platform allows you...

Securing telecommuting: the complete guide

How to secure telecommuting? In recent months, we have published various articles on cybersecurity and telecommuting. Indeed, the context of the health crisis has led to an increase in...

"Browser in the Browser": A New Variant of Phishing

A new variant of phishing has been observed lately, called Browser in the Browser (BitB). It is simply an attack aiming to deceive usual human detection techniques by generating a fake window...

How to Assess Phishing Risk & Strengthen Your Defenses

Phishing is the entry point for 90% of cyberattacks today. This threat poses various risks to a company, including organizational, reputational, financial, and legal risks. It is therefore...

The phishing of Instagram accounts

Instagram is a very popular social network, so it is logical that phishing on Instagram is just as popular. According to a study, "Digital Report 2021" published by Hootsuite and We Are Social,...

Why carry out phishing simulations with groups of employees?

The aim of your phishing campaigns is to get as close as possible to real attacks threatening your company in order to improve your resilience against them. Some hackers are increasingly focusing...

Vishing examples: real world attacks and consequences