The Client's Website Got Blocklisted, Then ZAP Came for Their Inbox
A URL reputation hit turned ZAP against a client's own mail. How we proved it, beat the quarantine expiry clock, and released 1,600 messages safely.
Incident Response
The Fake Microsoft Login Page That Registered a Device
An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.
The Vendor Was the Phish: Responding to an AiTM Compromise in Microsoft 365
A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.