MFA doesn't protect you if your users approve access themselves. Here's how attackers are hijacking @Microsoft365 & @Azure OAuth, and what to do about it. ๐งต
Follow-up training, personalized to what each employee actually did, completes the cycle. Not a generic module blasted to everyone. The right lesson, for the right person, at the right moment.
Crypto, blockchain, and DeFi companies operate in an environment of irreversible settlement, distributed counterparties, and fragmented security frameworks. That creates an ideal attack surface.
Attackers know it. So do we. Here's our solution:
https://t.co/xviQMHl1cs
Crypto, blockchain, and Web3 companies are targeted by social engineering attacks. Irreversible transactions & distributed teams make them targets. 40% of crypto security incidents stem from social engineering.
@Arsen fixes this.
Over $200 million in financial losses were attributed to deepfakes in Q1 2025, and 44% of financial professionals have already reported deepfake-driven fraud. Here are three concrete controls you can deploy:
https://t.co/b0djfywyHo
We got tons of notifications because @Arsenal qualified for the #UCL, and our handle @arsen starts almost the same! Do you know this reflects a #phishing tactic? It's called #typosquatting (aka URL hijacking), where fraudsters exploit typing mistakes to redirect to fake sites. ๐
#CustomerStory@odaseva needed security awareness training that could scale with their global workforce. With Arsen, they got it: localized campaigns, zero friction, real behavioral insights.
Read the full story ๐ https://t.co/qgRmEeqk04
#SocialEngineering@Mandiant (@googlecloud) recently released its M-Trends 2026 report, confirming vishing is now the second most common initial breach vector globally and the #1 vector in cloud environments.
๐https://t.co/zxxpN3CGBZ
Over the past few weeks, we deployed a redesigned cyber awareness training module, now available to all customers. It delivers adaptive, engaging learning that drives behavior change, not just compliance knowledge.
๐ https://t.co/jSi8WEx4mC
The @vercel breach didn't start at Vercel. It started with a 3rd party. We'll learn more in the coming days, but if it's really ShinyHunters, social engineering on top of weakness exploitation is very probable.
Either way: 3rd party + human surface remains a key entry point.
๐ฅ From a cloned CEO identity to a fake Slack workspace and a fake Microsoft Teams error: the perfect multi-step #SocialEngineering attack?
Read the report ๐
https://t.co/Wl2NM7nXgG
According to @ESET, ClickFix attacks surged by 517% in 2025. This social engineering trick can make your employees run malware on their own. @MsftSecIntel and @moonlock_lab recently detected two new massive schemes using this technique. Find out how.๐
https://t.co/xJcO6b8u2n
@MsftSecIntel Arsen offers ready-made 'ClickFix' simulation campaign scenarios. Test your employees on real attacker tactics: multi-step social engineering sequences that lead to a deceptive action request.
https://t.co/gAGhhLS6SO
Bad actors are impersonating and weaponizing legitimate Microsoft tools thousands of firms use, using 'ClickFix' attacks - @MsftSecIntel. Arsen's simulations now allow security teams to mimic similar ClickFix attacks to assess and train their employees. Learn more below. ๐
Microsoft Defender Experts identified a widespread ClickFix social engineering campaign in February 2026 leveraging Windows Terminal as the primary execution mechanism. Rather than the traditional Win + R โ paste โ execute technique, this campaign instructs targets to use the Windows + X โ I shortcut to launch Windows Terminal (wt.exe) directly, guiding users into a privileged command execution environment that blends into legitimate administrative workflows and appears more trustworthy to users.
This approach bypasses detections specifically tuned to Run dialog abuse while exploiting the legitimacy and familiarity of Windows Terminal. Once the terminal is opened, targets are prompted to paste malicious PowerShell commands delivered through fake CAPTCHA pages, troubleshooting prompts, or verification-style lures designed to appear routine and benign.