Finding talent for a fast-growing tech startup is a challenge, especially in competitive markets like Silicon Valley. The solution to hiring the people you need without waiting forever, poaching from competitors, and breaking your salary budget? Look beyond your local market for new sources of talent. At Agari, we are always on the lookout for talent near our Bay Area headquarters. But we also...

You likely have a fraudulent email from a business email compromise (BEC) scammer sitting in your inbox, and you may not realize it. However, recent research from the Agari Cyber Intelligence Division (ACID) has shown that these advanced phishing attacks increasingly possess a handful of commonalities, making them easier to spot—which is good news considering their popularity. There are more BEC...

Enterprise email architecture is evolving, which is good news for cybercriminals. Legacy secure email gateways (SEGs) simply don't provide full protection from today’s evolving and costly attacks, and cloud-based email requires a new security approach. In contrast, the next generation of email security—the AI-powered Secure Email Cloud —gives organizations more comprehensive security and better...

Every year, the Internet Crime Complaint Center , also known as IC3, publishes an annual report looking at the different types of internet-based crimes reported to the FBI. Over the last year, victims around the globe lost $2.71 billion to all types of cybercrime, which includes lottery scams, hacktivism, gambling fraud, malware, ransomware attacks, and tech support fraud, among others. While each...

The type of email attacks that helped derail Hillary Clinton’s presidential bid during the 2016 presidential election cycle could be a prelude to the aggressive tactics we may see in 2020—and new data suggests early candidates and their campaigns aren’t ready to defend themselves. According to analysis captured in the Email Fraud and Identity Deception Report from the Agari Cyber Intelligence...

Three years ago, Russian operatives spear phished the email account of Hillary Clinton's campaign chairman during the 2016 US presidential election. Even though that memory looms over candidates and the country, Agari analysis finds that 83 percent of the top candidates still have vulnerable email accounts —and even fewer have implemented the authentication necessary to prevent email impersonation...

Historically, business email compromise (BEC) threat actors have used wire transfers as a means to steal money from businesses. Impersonating a trusted contact, usually a company executive, a scammer requests that a fictitious vendor get paid by sending money to a bank account controlled by the scammer or an associate. Today though, we've seen a new trend: cybercriminals outright asking for...

Imagine this scenario: you call your high-profile client on your way into the office to check in and see if they’re ready to make the multimillion-dollar down payment on a new property. They tell you they wired it yesterday, following your email instructions. But you never sent them an email. Now you have to tell your client that that email didn’t come from you. Except that it did—or at least from...

It’s like clockwork. Every year around tax time security vendors ( even us! ) push out warnings about W-2 forms being stolen at tax time, and every year dozens of organizations disclose that someone inside of their organization fell victim to a BEC scam where actors were asking for W-2 information. Historically, actors switch to W-2 phishing campaigns starting at the end of January, and typically...

Scammers know that impersonating a trusted government agency is an extremely effective way to trick or scare victims into handing over money, personal data, or sensitive information. In many cases, it’s all too easy for cybercriminals to use the agency’s own domains to send authentic-looking phishing emails to constituents and contractors. That’s why the Department of Homeland Security announced...

The April 15th deadline to file taxes in the United States is almost here, which means Tax Day phishing operations are in high gear. Impersonating the IRS is a year-round favorite tactic for cybercriminals. In fact, the IRS was the third most-impersonated brand in Q4 2018. But with the April 15th deadline on the horizon, criminals know that now is the perfect time to exploit anxiety, distraction...

When it comes to sharing threat intelligence with one another, organizations tend to play the game differently. Some prefer to play the “secret squirrel game,” where attribution is something so sacred that names of actors can only be whispered behind closed doors. In other cases, data is bought on the dark underbellies of the Internet and then sold back to organizations as threat intelligence. For...

With competition soaring and email-based brand impersonation scams skyrocketing 11x since 2014, your most important digital marketing channel could be in serious danger—along with the revenue it generates. But an email standard called Brand Indicators for Message Identification (BIMI) offers a way to fight back. BIMI is an emerging standard that enables brands to display their logos in email...

In December, the Agari Cyber Intelligence Division (ACID) published a report on a business email compromise group of cybercriminals we call London Blue. In this report , we documented how this group, which has roots in the United Kingdom, evolved its tactics over time, from Craigslist scams to enterprise credential phishing to business email compromise as they matured into a criminal enterprise...

As someone who joined Agari nearly five years ago as part of the core team building our breakthrough email security solutions, I am extremely proud of what we built, and I can't wait for you to see what's next. This is—after all—a race against time. In the battle against costly spear phishing attacks, business email compromise (BEC) scams, and other advanced email threats, serious solutions can...

One of the trends that has been slowly creeping up across the BEC threat landscape is that actors are using other techniques in order to get money outside of an organization. While a traditional BEC attack includes instructions for wiring money outside of the organization, more and more actors are asking for a large number of gift cards instead of the classical request of “Please wire $30,000 to...

This post originally appeared on the Armadillo Blog and has been lightly edited for clarity. Most organisations have been successful in blocking malicious emails targeted at their employees, at least to some extent. Various on-premise and cloud providers exist to take care of anti-spam, anti-virus, reputation scores, and advanced features such as sandboxing of executables. As a service provider...

We all know that phishing attacks came fast and furious. Timed and tailored for maximum effect, these malicious email messages exploit the cruelest of social engineering tactics , preying on customer anxieties, especially in the aftermath of major crises. This past May, UK banking giant TSB experienced one of these phishing-related emergencies. First came breaking news of a massive system meltdown...

Business email compromise (BEC) is a term that encompasses a variety of techniques and tactics that cybercriminals leverage to obtain money or data via identity deception. Despite the evolution and repurposing of this suite of associated tactics, one constant has remained throughout—the correspondence between scammer and victim is done, almost without exception, over email. This foundational...

With the 2019 tax season reaching full throttle, a volatile mix of conditions could fuel an unprecedented barrage of W-2 phishing scams through mid-April this year. For the businesses and employees who fall victim, the results can be disastrous. W-2s, of course, are the IRS documents that United States businesses provide employees after the end of each year, documenting the employee's earnings...