Technical Advisory · Retrospective 2024
ClickFix asks the user to cross the execution boundary
A repair prompt can be a malware-delivery step. Investigate the requested action and whether it actually ran.
Subject
Phishing
Published work
Technical Advisory · Retrospective 2022
AiTM phishing: why a completed MFA prompt can still end in session theft
The recovery task follows the stolen session into the mailbox, its persistence settings and the business conversations it exposed.