https://www.phishclean.com/blog Phishing and scam campaigns worth knowing about, browser-security guides and PhishClean product updates. en Fri, 09 Oct 2026 12:00:00 GMT https://www.phishclean.com/blog/whats-new-phishclean-1-5-0 https://www.phishclean.com/blog/whats-new-phishclean-1-5-0 Fri, 09 Oct 2026 12:00:00 GMT About 378,000 reported phishing sites blocked for free and checked on your device, a warning on fake virus pages before you call the number, and a fix for plain http:// pages. https://www.phishclean.com/blog/whats-new-phishclean-1-4-0 https://www.phishclean.com/blog/whats-new-phishclean-1-4-0 Sat, 26 Sep 2026 12:00:00 GMT A heads-up when a site you sign in to has had a data breach, and a private check that tells you if the password you type has already leaked. Powered by Have I Been Pwned. https://www.phishclean.com/blog/weekly-phishing-roundup-2026-09-25 https://www.phishclean.com/blog/weekly-phishing-roundup-2026-09-25 Fri, 25 Sep 2026 12:00:00 GMT Microsoft and UK police take down EvilTokens, Revolut customers get phishing texts days after a breach, fake Bitrefill checkouts turn up in search results, and a Zoom/DocuSign wave hits inboxes. https://www.phishclean.com/blog/fake-e-challan-scam-india-2026 https://www.phishclean.com/blog/fake-e-challan-scam-india-2026 Fri, 25 Sep 2026 12:00:00 GMT An SMS says you owe a traffic fine. The link opens a copy of the Parivahan site that only takes cards, or asks you to install "RTO Challan.apk". How the scam works and how to check a challan safely. https://www.phishclean.com/blog/fbi-oauth-consent-phishing-warning https://www.phishclean.com/blog/fbi-oauth-consent-phishing-warning Fri, 25 Sep 2026 12:00:00 GMT No fake login page, no stolen password. The victim signs in on the real Google or Microsoft page and clicks Allow, and a malicious app keeps access even after a password change. https://www.phishclean.com/blog/invisible-unicode-phishing-ascii-smuggling https://www.phishclean.com/blog/invisible-unicode-phishing-ascii-smuggling Fri, 25 Sep 2026 12:00:00 GMT A technique from AI prompt-injection research turned up in a phishing campaign that peaked at 2.37 million messages a day. The words look normal to you, but the filter reads something different. https://www.phishclean.com/blog/helpdesk-vishing-financial-firms-2026 https://www.phishclean.com/blog/helpdesk-vishing-financial-firms-2026 Fri, 25 Sep 2026 12:00:00 GMT Callers pose as the IT helpdesk, push an urgent "security migration", and send employees to login portals that capture passwords and MFA codes as they are typed. Ransom demands reach $3 million. https://www.phishclean.com/blog/whats-new-phishclean-1-3-0 https://www.phishclean.com/blog/whats-new-phishclean-1-3-0 Fri, 25 Sep 2026 12:00:00 GMT A pages-checked count on the toolbar, a weekly safety report, a what-to-do-now guide for bad clicks, detection for common Indian scam pages, and rupee pricing. https://www.phishclean.com/blog/whats-new-phishclean-1-2-0 https://www.phishclean.com/blog/whats-new-phishclean-1-2-0 Mon, 21 Sep 2026 12:00:00 GMT Pay in two clicks with no account, a one-time heads-up on the day the trial ends, two checks that never expire, and a fix for paid status carrying over to a new account. https://www.phishclean.com/blog/whats-new-phishclean-1-1-6 https://www.phishclean.com/blog/whats-new-phishclean-1-1-6 Wed, 15 Jul 2026 12:00:00 GMT Lookalike and homograph domain detection, live re-scanning on SPA navigation and DOM changes, deeper secret scanning, and a more accessible warning modal. https://www.phishclean.com/blog/ghost-phishing-eviltokens-browser-blind-spot https://www.phishclean.com/blog/ghost-phishing-eviltokens-browser-blind-spot Tue, 14 Jul 2026 12:00:00 GMT The EvilTokens wave ships its page as encrypted code that only decrypts inside your browser, so URL and email scanners see nothing. Why the browser is the real blind spot. https://www.phishclean.com/blog/entra-passkey-enrollment-vishing https://www.phishclean.com/blog/entra-passkey-enrollment-vishing Sun, 12 Jul 2026 12:00:00 GMT Okta warns of a vishing campaign that calls employees, walks them through a fake Microsoft Entra passkey setup, and quietly registers the attacker's own passkey on the real account. https://www.phishclean.com/blog/24-billion-credential-dump-stuffing https://www.phishclean.com/blog/24-billion-credential-dump-stuffing Fri, 10 Jul 2026 12:00:00 GMT A 24-billion-record credential database built from infostealer logs and enriched with live CVE data was found exposed. Why it fuels credential stuffing - and what actually helps. https://www.phishclean.com/blog/gitbait-github-pages-banking-phishing https://www.phishclean.com/blog/gitbait-github-pages-banking-phishing Wed, 08 Jul 2026 12:00:00 GMT The GitBait campaign abused GitHub Pages to host fake banking portals, borrowing a trusted domain's reputation to steal logins and card details. Why trusted-host phishing works. https://www.phishclean.com/blog/google-oauth-phishing-surge-2026 https://www.phishclean.com/blog/google-oauth-phishing-surge-2026 Thu, 18 Jun 2026 12:00:00 GMT A look at why OAuth consent and redirect abuse is rising, and how to spot risky authorization flows. https://www.phishclean.com/blog/chrome-extension-malvertising-wave https://www.phishclean.com/blog/chrome-extension-malvertising-wave Thu, 18 Jun 2026 12:00:00 GMT Extensions injecting ads and redirects can push users into phishing pages; how to audit extensions and reduce risk. https://www.phishclean.com/blog/mfa-fatigue-attacks-rise https://www.phishclean.com/blog/mfa-fatigue-attacks-rise Thu, 18 Jun 2026 12:00:00 GMT Understanding MFA fatigue and steps to reduce exposure, including phishing-resistant second factors and browser signals. https://www.phishclean.com/blog/supply-chain-sms-phishing https://www.phishclean.com/blog/supply-chain-sms-phishing Thu, 18 Jun 2026 12:00:00 GMT Why supply-chain or provider-abuse phishing via SMS is growing, and what to check in the browser after clicking links. https://www.phishclean.com/blog/oauth-redirect-campaign-mitigation https://www.phishclean.com/blog/oauth-redirect-campaign-mitigation Thu, 18 Jun 2026 12:00:00 GMT A practical mitigation guide for consent settings, redirect review, user education, browser checks, and response steps. https://www.phishclean.com/blog/european-commission-cloud-breach-aws-exposure https://www.phishclean.com/blog/european-commission-cloud-breach-aws-exposure Mon, 06 Apr 2026 12:00:00 GMT A recent europa.eu breach tied to a compromised cloud account is a reminder that public-facing infrastructure can still expose directories, keys, and documents with real downstream risk. https://www.phishclean.com/blog/carecloud-patient-data-breach-sec-filing https://www.phishclean.com/blog/carecloud-patient-data-breach-sec-filing Mon, 06 Apr 2026 12:00:00 GMT CareCloud's SEC filing shows why a short-lived healthcare breach can still become material when patient information may have been reachable or exfiltrated. https://www.phishclean.com/blog/best-affiliate-products-for-cybersecurity-bloggers https://www.phishclean.com/blog/best-affiliate-products-for-cybersecurity-bloggers Mon, 06 Apr 2026 12:00:00 GMT What security creators should look for in affiliate products and why narrower browser-security SaaS can be easier to recommend credibly. https://www.phishclean.com/blog/best-browser-security-affiliate-programs https://www.phishclean.com/blog/best-browser-security-affiliate-programs Mon, 06 Apr 2026 12:00:00 GMT A practical look at browser-security affiliate programs, what audiences actually care about, and why phishing-focused tools are easier to explain honestly. https://www.phishclean.com/blog/how-to-promote-affiliate-products-without-losing-trust https://www.phishclean.com/blog/how-to-promote-affiliate-products-without-losing-trust Mon, 06 Apr 2026 12:00:00 GMT How creators can write affiliate content that still feels credible, especially in privacy, security, and technical niches. https://www.phishclean.com/blog/microsoft-oauth-redirection-phishing-malware https://www.phishclean.com/blog/microsoft-oauth-redirection-phishing-malware Sat, 21 Mar 2026 12:00:00 GMT Microsoft says attackers are abusing legitimate identity-provider redirects to move users from trusted login URLs to phishing pages and malware. https://www.phishclean.com/blog/fbi-zoning-permit-phishing-scam https://www.phishclean.com/blog/fbi-zoning-permit-phishing-scam Sat, 21 Mar 2026 12:00:00 GMT The FBI says criminals are using real permit details and urgent payment lures to make city and county phishing emails feel routine. https://www.phishclean.com/blog/purchase-order-pdf-telegram-phishing https://www.phishclean.com/blog/purchase-order-pdf-telegram-phishing Sat, 21 Mar 2026 12:00:00 GMT A fake purchase-order attachment reported this month shows how a browser page can hide inside a so-called PDF and steal business credentials. https://www.phishclean.com/blog/fake-google-security-pwa-phishing https://www.phishclean.com/blog/fake-google-security-pwa-phishing Sat, 21 Mar 2026 12:00:00 GMT Researchers say a fake Google security page is abusing PWA installation and browser permissions to steal OTPs, contacts, and more. https://www.phishclean.com/blog/google-meet-update-device-enrollment-phishing https://www.phishclean.com/blog/google-meet-update-device-enrollment-phishing Sat, 21 Mar 2026 12:00:00 GMT A recent report says a fake Meet update page can push users into attacker-controlled device management without starting with a password prompt. https://www.phishclean.com/blog/starbucks-phishing-breach-partner-central-employees https://www.phishclean.com/blog/starbucks-phishing-breach-partner-central-employees Thu, 19 Mar 2026 12:00:00 GMT Nearly 900 Starbucks employees were reportedly affected after phishing sites impersonated the company's HR portal. Here is why HR logins are such a high-value target. https://www.phishclean.com/blog/the-browser-has-become-the-most-overlooked-security-risk-in-everyday-life https://www.phishclean.com/blog/the-browser-has-become-the-most-overlooked-security-risk-in-everyday-life Tue, 17 Mar 2026 12:00:00 GMT Why ordinary users and teams keep getting hurt by browser-level risk, and why the modern web is very good at looking trustworthy while doing something dangerous underneath. https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus Sun, 15 Mar 2026 12:00:00 GMT Fake verification pages are increasingly telling users to paste commands into Run or PowerShell. Here is why that is dangerous and what to do if you already did it. https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications Sun, 15 Mar 2026 12:00:00 GMT A lot of scam pages only want one thing from you: notification permission. Here is what happens after that click and how to undo it. https://www.phishclean.com/blog/i-scanned-a-qr-code-now-what https://www.phishclean.com/blog/i-scanned-a-qr-code-now-what Sun, 15 Mar 2026 12:00:00 GMT A practical response guide for suspicious QR scans, including what matters if you only opened the page, entered a password, or made a payment. https://www.phishclean.com/blog/why-a-phishing-site-can-look-safe-on-desktop-but-not-phone https://www.phishclean.com/blog/why-a-phishing-site-can-look-safe-on-desktop-but-not-phone Sun, 15 Mar 2026 12:00:00 GMT Mobile screens hide context attackers want you to miss. Here is why suspicious pages often feel more convincing on phones. https://www.phishclean.com/blog/can-a-browser-extension-steal-my-login-session https://www.phishclean.com/blog/can-a-browser-extension-steal-my-login-session Sun, 15 Mar 2026 12:00:00 GMT Why extension permissions matter more than most users think, and how session theft risk fits into the broader browser-security picture. https://www.phishclean.com/blog/why-phishing-pages-look-real https://www.phishclean.com/blog/why-phishing-pages-look-real Sun, 15 Mar 2026 12:00:00 GMT Modern phishing pages are built to feel familiar in the first two seconds. Here is why they work and what still gives them away. https://www.phishclean.com/blog/how-to-spot-phishing-email-that-looks-legit https://www.phishclean.com/blog/how-to-spot-phishing-email-that-looks-legit Sun, 15 Mar 2026 12:00:00 GMT Polished phishing emails are the dangerous ones. Learn the signs that still matter when a message looks professional. https://www.phishclean.com/blog/why-browser-warnings-often-come-too-late https://www.phishclean.com/blog/why-browser-warnings-often-come-too-late Sun, 15 Mar 2026 12:00:00 GMT Why a dangerous page can still look normal before any browser warning appears, and why attackers rely on that delay. https://www.phishclean.com/blog/what-can-go-wrong-on-public-wifi-even-with-https https://www.phishclean.com/blog/what-can-go-wrong-on-public-wifi-even-with-https Sun, 15 Mar 2026 12:00:00 GMT The lock icon helps, but it does not eliminate every risk on public Wi-Fi. Here is what still matters. https://www.phishclean.com/blog/how-to-tell-if-a-microsoft-365-login-page-is-fake https://www.phishclean.com/blog/how-to-tell-if-a-microsoft-365-login-page-is-fake Sun, 15 Mar 2026 12:00:00 GMT One stolen Microsoft 365 login can expose an entire workday. Here is what to check before entering your password. https://www.phishclean.com/blog/how-to-remove-fake-virus-popup https://www.phishclean.com/blog/how-to-remove-fake-virus-popup Fri, 06 Mar 2026 12:00:00 GMT Still getting the warning after a virus scan? It is almost always a site allowed to send notifications. Exact steps for Chrome, Edge, Firefox, Safari, Android and iPhone. https://www.phishclean.com/blog/protect-elderly-parents-from-online-scams https://www.phishclean.com/blog/protect-elderly-parents-from-online-scams Fri, 06 Mar 2026 12:00:00 GMT A practical guide to protecting elderly parents from phishing, tech support scams and fake virus popups — without being condescending about it. https://www.phishclean.com/blog/what-to-do-after-phishing-attack https://www.phishclean.com/blog/what-to-do-after-phishing-attack Mon, 02 Mar 2026 12:00:00 GMT You clicked the link. You entered your password. Now what? A step-by-step guide to limiting the damage — from changing passwords to freezing accounts. https://www.phishclean.com/blog/how-to-check-if-website-is-safe https://www.phishclean.com/blog/how-to-check-if-website-is-safe Mon, 02 Mar 2026 12:00:00 GMT Before you enter your password, check these 7 things. Most phishing pages fail at least two of them — if you know what to look for. https://www.phishclean.com/blog/localstorage-token-security-risks https://www.phishclean.com/blog/localstorage-token-security-risks Wed, 25 Feb 2026 12:00:00 GMT If you're storing JWTs in localStorage, every script on the page can read them. That's not a bug — it's how localStorage was designed. Here's why it matters and what to do instead. https://www.phishclean.com/blog/what-are-api-key-leaks https://www.phishclean.com/blog/what-are-api-key-leaks Tue, 24 Feb 2026 12:00:00 GMT API keys are the passwords of the modern web. When they leak, attackers get direct access to your cloud infrastructure, payment systems, and user data. Here's everything you need to know.