Book a demo →
Series A
$36M led by Battery Ventures, with Accel and Foundation Capital
Posts

Written by this author

September 18, 2026

The Inbox Has a Second Reader: Prompt Injection in Gemini and Copilot

Attackers hide instructions in email that Gemini and Copilot read and that people cannot see. How email prompt injection works, and how Aegis catches it.

Read the post →
September 11, 2026

Midnight Blizzard-Linked Actor GTG-20006 Automated Device Code Phishing With AI

Anthropic says GTG-20006, a Midnight Blizzard-linked actor, used AI to automate device code phishing against 20+ government and defense organizations.

Read the post →
September 8, 2026

Email Security Threats in 2026: BEC, AiTM, and Zero-Day Phishing Explained

The 2026 email threat landscape: BEC, vendor email compromise, AiTM session theft, and zero-day phishing, the attacker tooling behind them, and why legacy filters miss them.

Read the post →
September 2, 2026

Google Calendar Phishing: The Invite That Installs an RMM Agent

Malicious Google Calendar invites rose tenfold in a week. Inside a campaign that auto-creates events from stolen mailboxes and installs a signed RMM agent.

Read the post →
September 2, 2026

Half of AI Phishing Reaches the Inbox. Then 60% of People Click.

CrowdStrike puts AI phishing click-through past 60%. Our analysis of 20,000+ emails shows why it arrives: 50.3% clears Gmail and Microsoft filters.

Read the post →
August 28, 2026

How Mirage2FA bypasses Microsoft 365 MFA with stolen session cookies

Yes, attackers bypass Microsoft MFA. The Mirage2FA AiTM kit relays the real login and takes the session cookie the moment MFA clears. Here is how it works.

Read the post →
August 17, 2026

Credential Phishing With No Payload: Inside the IEH Microsoft 365 Mailbox Breach

A credential phishing email with no malware opened a Microsoft 365 mailbox at IEH Corporation, a U.S. defense supplier. How the account takeover worked.

Read the post →
July 31, 2026

Kali365: How a Device-Code Phishing Kit Defeated MFA Without Breaking It

A $250-a-month phishing kit turned a legitimate Microsoft sign-in feature into a way to steal Microsoft 365 access without a password, a credential form, or a single attacker-owned domain, then staged its own shutdown and kept running under a new name.

Read the post →
July 4, 2026

TIDALGUEST: A Self-Replicating Invitation Phishing Cluster

TIDALGUEST is a self-replicating invitation phishing cluster that turns each stolen inbox into a new sender and layers five evasion techniques past URL scanning.

Read the post →
February 11, 2026

Aegis Threat Intelligence: Sharpening the Harpoon – Direct Send Abuse Still Fueling Modern Spearphishing

The call is coming from inside the house: How threat actors act as 'internal' users to bypass your security stack.

Read the post →