Netcraft

A new phishing platform called Bluekit doesn't steal your credentials in transit. It does something more unsettling: Loads the real login page inside an attacker's browser and streams it directly to you.

A new scam prevention framework is coming to Australia. Are banks ready? Click the link in the comments to find out what steps financial institutions need to take before the March deadline. #scams #banking #Australia

The World Cup continues this week. But the attack infrastructure targeting fans was built last year. More than 4,400 fake FIFA-related domains were registered between August 2025 and the start of the tournament — some even earlier. These included fake ticketing sites, and impersonation domains combining sponsor names with terms like "VIP," "resale," and "stream." Some are already being positioned for the 2030 and 2034 tournaments. This is how modern phishing campaigns work: Attackers don't register a domain months in advance, let it age, accumulate SSL certificates, and build search credibility — then activate it when traffic is expected to be at its peak. By the time a fake domain looks like a phishing site, it often already outranks the legitimate site it's impersonating. Most domain protection programs are calibrated to detect abuse after it goes live, but that window is often already too late. Effective protection has to start at registration — monitoring newly registered lookalikes, clustering related infrastructure, and disrupting threats before content ever appears. We wrote about what this looks like in practice, and what the World Cup registration data reveals about how attack infrastructure is built. Link in the comments.

A phishing page that doesn't ask for your password. It asks for your face.  Netcraft researchers recently identified a new technique where browser camera permissions — not credential forms — become the collection channel. Here's how it works. 

Introducing... "The Takedown." Each week, we'll have a new recap of a recent major threat intelligence finding, research nugget, or any other trend on the threat landscape we think you should know about. First up: When attackers weaponize your devices' cameras to phish you.

What if your users are logging into the real site… just not from their own browser? That’s exactly what Bluekit enables. This new phishing kit streams live login pages from an attacker-controlled browser, so victims unknowingly authenticate directly into the attacker’s session — a seamless (and dangerous) illusion. Netcraft’s latest analysis breaks it down here: https://lnkd.in/e4ZKCNbJ #CyberThreats #Phishing #SecurityAwareness #Infosec

The best security conversations tend to happen when people can be open about what’s actually working, and what isn’t. In our IWG Rewind sessions, we’re sharing key takeaways from Netcraft’s closed working group —  where practitioners, partners, and industry peers shared how they’re responding to an increasingly effective cybercriminal landscape.  Expect practical insights drawn from:  - Real-world disruption strategies  - What teams are seeing right now  - Where approaches are evolving  Register today to be among the first to receive access: https://lnkd.in/eZhbqaA5 

Getting an alert that a phishing site is impersonating your brand doesn't protect your customers. It just means you know about the problem.  The actual risk lives in the hours or days your team spends on manual triage, cross-team handoffs, and figuring out who owns the removal request. While all that's happening, the site is live.  Effective brand protection isn't measured by alert volume, it's about how fast threats get removed and whether the infrastructure behind them gets dismantled so attackers can't just spin up the same campaign with a new domain.  More on the full detection → validation → takedown lifecycle in the comments

Most people believe they'd recognize a phishing website, but that assumption can be dangerous. Netcraft researchers documented 10 real phishing sites identified during active investigations — Netflix, Booking DOT com, USPS, Kuda, and others. What stands out across all of them isn't just how convincing they look, it's how differently they operate. Screenshots and full analysis in the comments. 

Most people believe they'd recognize a phishing website, but that assumption can be dangerous. Netcraft researchers documented 10 real phishing sites identified during active investigations — Netflix, Booking DOT com, USPS, Kuda, and others. What stands out across all of them isn't just how convincing they look, it's how differently they operate. Screenshots and full analysis in the comments.