#blog

Field notes from the threat intelligence frontier

#blog

Field notes from the threat intelligence frontier

Threat Analysis

146% in 60 Days: Inside the QR Phishing Surge Your Stack Can't See

Microsoft reported a 146% jump in QR phishing between January and March 2026. The attack lives inside an image, runs on a personal device, and never touches your network. Why your stack misses it — and what the 96-minute-vs-96-hour asymmetry actually looks like.

Threat Analysis

146% in 60 Days: Inside the QR Phishing Surge Your Stack Can't See

Industry Insights

98 mins vs. 5 days: The Speed Gap That's Defining Modern Cybersecurity

Average attacker breakout time has dropped under 98 minutes. Average threat investigation time is still measured in days. Why is the speed gap is widening? And what would it take to close it?

Threat Analysis

Inside the "Snow" Malware Suite: From a Microsoft Teams Chat to a Full Network Compromise

A new malware campaign tracked by Mandiant and Google GTIG turns a Microsoft Teams invite into full network compromise. How the Snow suite (SnowBelt, SnowGlaze, SnowBasin) operates, and what your team should be hunting for right now.

Threat Analysis

Condé Nast, 2.3M WIRED Subscribers, and the Real Cost of Slow Threat Intelligence

A threat actor leaked 2.3M WIRED subscriber records and threatened 40M more. We explore why investigation speed has become the most underrated vulnerability in modern security operations.