phishing
Safeguard articles tagged "phishing" — guides, analysis, and best practices for software supply chain and application security.
26 articles
How Can You Prevent the Download of Malicious Code?
You prevent the download of malicious code with layered controls: verified sources, dependency scanning, browser and endpoint protection, and least-privilege execution.
Open Redirect Vulnerabilities: How Attackers Abuse Them
An open redirect attack abuses a trusted domain's own redirect functionality to send victims to a malicious site — low severity on its own, but a key ingredient in phishing and OAuth token theft.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
What is Phishing
Phishing drives more breaches than any other attack vector. Here's how it works, how it hits software supply chains, and how to defend against it.
What is Social Engineering
Social engineering causes 68% of breaches per Verizon's 2024 DBIR. Learn how it works, common attack types, and how it threatens the software supply chain.
Webmail Auth: How Email Authentication Actually Works
Webmail auth spans two very different problems: proving who a user is when they sign in, and proving a message really came from the domain it claims. Both matter for security.
OSS Maintainer Account Takeover Trends 2025
A senior engineer's breakdown of how maintainer account takeovers evolved in 2025, from phishing kits targeting PyPI to session token theft on GitHub and npm.
Business email compromise (BEC)
Business email compromise (BEC) tricks employees into wiring funds or data to attackers posing as executives or vendors. Here is how BEC fraud actually works.
Dark AI: How Attackers Weaponize Generative Models
Dark AI refers to generative models turned to malicious ends, from phishing at scale to malware assistance. Here is what defenders need to understand and do.
Email Security and Supply Chain Phishing Attacks
Phishing remains the top initial access vector for supply chain attacks. Targeted emails against developers, maintainers, and DevOps engineers open the door to code injection, credential theft, and pipeline compromise.
Dropbox Breach: Phishing Attack Exposes 130 Private GitHub Repositories
Attackers phished Dropbox employees by impersonating CircleCI, gaining access to 130 private GitHub repos containing internal code and credentials.
0ktapus: The Phishing Campaign That Hit Cloudflare, Twilio, and 130+ Organizations
A single phishing campaign compromised over 130 companies including Cloudflare and Twilio. Here's how the 0ktapus attack chain worked.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.