Tradecraft Tuesday | Shadiest Catch: Looking Back (And Forward) at Phishing Tactics

This webinar analyzes evolving phishing tactics, emphasizing the rise of platform abuse, sender spoofing, and AI-driven content to bypass traditional security controls.

Key Takeaways:
• Hosts engage the audience to share experiences with phishing templates, highlighting the prevalence of opportunistic attacks tied to current events 0:16.
• Google’s lawsuit against the "Smishing Triad" underscores the scale of SMS phishing scams, which have affected over 1 million victims globally 0:35.
• Attackers increasingly abuse legitimate platforms (e.g., DocuSign, DoorDash) to send emails from trusted domains, rendering sender inspection less effective 15:20.
• Voicemail lures and shipping notifications are common vectors, often using SVG attachments or image-based links to evade email security gateways 20:45.
• "Living off the land" techniques involve using trusted sites like Figma or Dropbox to host malicious landing pages, masking the final destination via redirects 35:10.
• Defense requires verifying unexpected alerts directly through official platforms rather than clicking links, even if the sender appears legitimate 45:30.

The session concludes that while AI improves phishing quality, layered verification and user skepticism remain critical defenses against sophisticated social engineering.

Sources:

• 0:05 Introduction and welcome
• 0:16 Audience engagement on phishing
• 0:35 Smishing and Google lawsuit discussion
• 15:20 Platform ab