About

I’m a cybersecurity manager who sees a steady stream of phishing emails at work. Some of them are clever, new or just interesting, so I write them up here: what the lure was, how the infrastructure worked, which techniques the attackers used, and the indicators other defenders can hunt for.

How these write-ups are handled

• Indicators are defanged. URLs and domains are written like hxxps://example[.]com so they can’t be clicked by accident.
• Victims are anonymized. Recipient names, addresses and anything that identifies an organization are redacted.
• No live malware is hosted here. Attachments are referenced by their hashes only.
• Techniques are mapped to MITRE ATT&CK where possible.

Opinions are my own and not my employer’s.