Secto Security Lab
Threat research, security engineering, and practical guidance for protecting modern work in the browser.
Latest intelligence
GhostFrame is a useful wake-up call because it does not just hide phishing behind a new domain or a better lure. It hides the real credential-harvesting experience inside the browser's rendering path, leaving many source-only inspections looking at the wrong thing.
The important change in GenAI-enabled phishing is not better email copy. It is the collapse in time and effort required to produce a convincing login page. Okta's 2025 reporting showed attackers using GenAI web-building tools to generate polished sign-in clones in roughly thirty seconds.
For decades, the corporate approach to cybersecurity has relied on a simple medieval concept: the castle and moat. We build strong perimeter defenses: firewalls, antivirus, and, crucially, Secure Email Gateways (SEGs) to keep the bad things out.
Traditional phishing was simple: send a fake login page, steal a password, log in. Multi-factor authentication (MFA) made that much harder… so attackers evolved. Modern attackers are increasingly using Adversary-in-the-Middle (AiTM) and Browser-in-the-Middle (BitM) techniques.
The landscape of phishing and social engineering is shifting. Attackers are moving away from just trying to steal credentials via fake login pages and are increasingly focused on immediate payload delivery. The newest, and particularly insidious, trend is the "ClickFix" attack.
In today's enterprise identity architecture, Okta often acts as the identity provider (IdP) for Microsoft Entra ID federated sign-ins.
A sophisticated phishing tactic is gaining traction: attackers are delivering internal-looking emails directly to Microsoft 365 mailboxes, completely bypassing Secure Email Gateways (SEGs) like Proofpoint or Mimecast.
Imagine your CEO receives a perfectly legitimate Microsoft 365 login page. Everything looks normal. They enter their credentials, complete the MFA prompt, and continue with their day.