Tag2 entries

authentication

Triage
ClickFix to BEC: the inbox rule gets the headline, the paste deserves it

I've lost count of how many BEC cases started with someone telling me "I didn't click anything." Okay sure - but what about pasting something? This week, Huntress published a walkthrough of an attack chain that ends in business email compromise (BEC). The specific post is From Overhyped to OH $#!T, and its "star" is Doris Stewart, a made up finance employee at Speedway Laundry. Doris googles ChatGPT for help with an email, clicks a sponsored result, and lands in a custom GPT built by an attacker. The GPT claims there's a service issue and sends her to a fake verification page, which tells her…

Oct 17, 2026 · 4 min read
Triage
iOS 27 gives Siri write access to your passwords - should it?

A few days ago at WWDC, Apple announced iOS 27 - with the biggest feature being a revamped Siri, called Siri AI. After looking at some of Siri AI's new features, I noticed it can now make changes inside the Passwords app. Specifically, it can now act on a weak or compromised credential by walking through a password rotation on the site for you, end to end. Agentic magic. At face value, the convenience is obvious: most people never rotate a leaked password because the flow is tedious and people can be naturally lazy. As incriminating as it is to admit, I am also one of those people (for my…

Jun 10, 2026 · 3 min read