Loading story…
A new initiative, hacklore.org, has been launched by former CISA advisor Bob Lord to address persistent cybersecurity myths and promote evidence-based security practices. The campaign, supported by an open letter signed by over 80 cybersecurity professionals, aims to shift public and organizational focus away from outdated advice—such as avoiding public Wi-Fi, never scanning QR codes, or frequently deleting cookies—and toward proven strategies like enabling multi-factor authentication, using strong passwords and passkeys, and keeping software up to date. The project also advocates for software companies to adopt "secure by design" and "secure by default" principles to improve overall digital safety.
The hacklore.org platform consolidates practical, fact-based cybersecurity guidance for individuals and small organizations, emphasizing actionable steps that genuinely enhance security. By challenging long-held superstitions and replacing fear-driven advice with accurate information, the initiative seeks to make digital safety advice more effective and accessible. The campaign has garnered support from cybersecurity leaders at major organizations, including Okta, Microsoft, and CISA, highlighting a broad consensus on the need to modernize cybersecurity education and awareness.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
A new public campaign, hacklore.org, launched to combat persistent cybersecurity misconceptions and promote practical guidance including strong passwords or passkeys, multi-factor authentication, social-engineering awareness, and secure-by-design software practices.
Former CISA advisor Bob Lord organized an open letter signed by more than 80 cybersecurity professionals calling for a shift away from outdated cybersecurity myths and toward evidence-based practices such as MFA, password managers, and software updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity awareness is increasingly recognized as a critical component for both individuals and organizations in the digital age. GuidePoint Security, in collaboration with the US National Cybersecurity Alliance and CISA, has emphasized the importance of Cybersecurity Awareness Month, focusing on themes such as 'Stay Safe Online' and 'Building a Cyber Strong America.' The narrative highlights how many individuals, especially young adults, often underestimate their vulnerability to cyber threats, assuming that built-in device protections are sufficient and that cyberattacks primarily target large organizations. However, the reality is that every digital interaction, from remote work to connecting to public Wi-Fi, introduces potential risks. The principles of cybersecurity, such as Zero Trust and secure device management, are not only relevant for enterprises but are also applicable to personal technology use. Individuals are encouraged to adopt a mindset of skepticism online, recognizing that neither devices nor people should be automatically trusted. The rapid evolution of technology necessitates continuous learning and adaptation of security practices. Organizations play a pivotal role in communicating complex cybersecurity concepts to non-technical audiences, helping bridge the gap between professional and personal security postures. The importance of hardening customer support tools against cyberattacks is also underscored, as these tools are often targeted by threat actors seeking to exploit vulnerabilities. Best practices for securing such tools include implementing strong authentication, regular monitoring, and employee training to recognize and respond to suspicious activities. Both references stress the need for a proactive approach to cybersecurity, advocating for ongoing education and the adoption of robust security frameworks. The collaboration between public and private sectors, as seen in national awareness campaigns, is vital for building a resilient cyber ecosystem. Individuals are urged to take personal responsibility for their digital safety, while organizations must ensure their support systems are fortified against evolving threats. The convergence of personal and organizational cybersecurity practices reflects the interconnected nature of modern digital life. By fostering a culture of awareness and vigilance, both individuals and enterprises can better defend against the growing landscape of cyber risks. The shared responsibility model is essential, with everyone playing a part in maintaining a secure online environment. Ultimately, cybersecurity awareness is not a one-time effort but an ongoing commitment to learning, adaptation, and collective action.
Jun 29, 2026
The cybersecurity community observed a range of significant developments and educational initiatives during the first week of October 2025. The SANS Institute launched a comprehensive Cyber Awareness Kit tailored for all generations, aiming to promote best practices and digital safety for both young and old users. This kit, released in conjunction with Cybersecurity Awareness Month, provides resources for families to protect themselves against evolving cyber threats. The SANS OUCH! Newsletter emphasized the risks associated with forgotten online accounts, highlighting how outdated or unused accounts can become entry points for attackers due to weak passwords or obsolete security measures. The newsletter recommended regular reviews and cleanups of digital accounts as a proactive defense strategy. In partnership with the International Spy Museum, cybersecurity expert and former FBI agent Eric O’Neill announced an event to discuss his upcoming book, "Spies, Lies, and Cybercrime," which explores the intersection of espionage, cybercrime, and emerging threats such as AI-powered scams and deepfakes. Meanwhile, Malwarebytes Labs reported on a variety of security incidents and trends from the week. Notably, hackers who had stolen child data were compelled to remove it from the internet following public backlash, demonstrating the impact of community response on cybercriminal behavior. The report also warned that conversations with Meta AI could be used to target users with personalized ads, raising privacy concerns. Scam Facebook groups were found distributing malicious Android malware to senior citizens, exploiting a vulnerable demographic. The FTC accused the app Sendit of deceiving children, harvesting their data, and fabricating messages, underscoring ongoing regulatory scrutiny of tech platforms. Researchers identified critical flaws in Gemini AI that could have exposed user data, prompting calls for improved AI security. Tile trackers were criticized for weak security controls, potentially enabling unauthorized tracking or data leaks. Apple addressed a critical vulnerability in its font processing system, urging users to update their devices to mitigate exploitation risks. A major Interpol operation resulted in the arrest of 260 individuals involved in romance scams and sextortion, disrupting a significant cybercriminal network. Amazon agreed to a $2.5 billion settlement over allegations of deceptive practices related to Prime subscriptions, reflecting increased enforcement against misleading business conduct. Additionally, a spyware breach exposed sensitive information about sex offenders, terrorists, and drug dealers, highlighting the risks associated with surveillance technologies. Collectively, these developments illustrate the dynamic and multifaceted nature of the cybersecurity landscape, with ongoing threats, regulatory actions, and educational efforts shaping the response to digital risks.
Jul 12, 2026
Cybersecurity Awareness Month, championed by the US National Cybersecurity Alliance and CISA, serves as a focal point for organizations and individuals to reinforce best practices in digital security. Despite the annual emphasis on education and awareness, phishing remains one of the most persistent and successful attack vectors targeting organizations worldwide. Security professionals continue to implement layered defenses, including robust identity management, multifactor authentication, and comprehensive user education, yet attackers adapt their tactics to bypass these controls. The identity industry has developed advanced authentication technologies specifically designed to resist phishing, but adoption rates remain low, leaving many organizations vulnerable. Phishing attacks often exploit human trust, as seen in campaigns that weaponize familiar brands such as Microsoft to lure victims into tech support scams. These scams use social engineering, fake system alerts, and deceptive user interfaces to trick users into divulging sensitive information or granting remote access. One recent campaign identified by the Cofense Phishing Defense Center used a payment lure, redirecting users through a fake CAPTCHA challenge to a malicious landing page, ultimately locking the browser and escalating the scam. Such attacks demonstrate the evolving sophistication of phishing schemes and the importance of not relying solely on brand recognition for security. Security Awareness Month initiatives are effective in raising awareness and sparking important conversations about risk, but their impact can wane without ongoing reinforcement and structural changes. Organizations often see a decline in vigilance after the campaign period, leading to lapses such as weak passwords and misconfigurations. To address these gaps, experts advocate for continuous validation of identity, configuration, and privilege, as well as proactive threat hunting to detect and mitigate threats that bypass traditional awareness training. The combination of technical controls, user education, and active threat detection forms a more resilient defense against phishing and other cyber threats. Ultimately, while awareness campaigns are valuable, they must be part of a broader, sustained effort to build a cyber-strong organization capable of resisting evolving attack techniques. The ongoing challenge is to translate awareness into lasting behavioral change and technical resilience, ensuring that users remain vigilant and systems are continuously monitored for signs of compromise. As phishing tactics grow more sophisticated, organizations must adapt by integrating advanced authentication, regular training, and proactive security measures into their daily operations. The lessons of Cybersecurity Awareness Month highlight both the progress made and the work still required to effectively combat phishing and related threats.
Jun 29, 2026