KnowBe4 Security Awareness Training

Tens of thousands of European organizations are legally accountable for the security of companies they do not control but on whose services they rely. Under Article 21(2)(d) of the NIS2 Directive, any in-scope entity is required to manage supply chain security, including the security aspects of its relationships with its direct suppliers and service providers. Article 21(3) further specifies that an organization must take each supplier’s specific vulnerabilities into account.

A phishing campaign is using AI-themed lures to target employees who operate advertising accounts, according to a new report from Island. The campaign is launched from a phishing platform that poses as a portfolio of AI advertising tools, using branding from Gemini, Claude, ChatGPT, Perplexity, and Muse. The platform’s operator added a fake Muse Ads lure eight days after Meta launched its Muse AI agent.

Microsoft is tracking phishing campaigns that use various lures to deliver MSP360, a legitimate RMM tool that attackers are abusing to gain a foothold on compromised systems.

Researchers at ReliaQuest have observed a surge in voice phishing (vishing) and Microsoft Teams phishing over the past several months, particularly from extortion groups like ShinyHunters.

Ransomware attacks involving data theft have surged by 275% in 2026, according to a new report from Zscaler. Attackers exfiltrated more than 896.2 terabytes of data from victim organizations, more than seven times the amount stolen during the 2023–2024 reporting period.

The digital landscape faces a new and complex challenge: the rise of generative AI. While these tools offer incredible potential for innovation, they also provide malicious actors with sophisticated ways to deceive even the most vigilant users.

Lead Analysts: Karthikeyan D, Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Somewhere in your security and compliance stack, there are records that prove your employees completed their security awareness training. But when these records need to serve as evidence, would they actually hold up to scrutiny?

Researchers at Fortra are tracking a new variant of calendar phishing in which threat actors trick employees into sharing meeting links internally. The attackers pose as prospective customers and contact non-sales employees, asking to be directed to a sales representative in order to discuss a business opportunity. The attacker then sends the employee a meeting link to forward to a sales contact.