April 15, 2025

Your KnowBe4 Fresh Content Updates from April 2026

May 1, 2026

John N Just, Ed.D. – Chief Learning Officer

What’s New: Celebrating World Password Day and Beyond
Happy May! This month, we are putting a major spotlight on World Password Day (May 7). While the “traditional” password might be evolving into passkeys and biometrics, the human element of authentication remains the #1 target for social engineers. To help you celebrate, we’ve released a dedicated suite of content designed to move your users beyond “Password123!” and into a mindset of strategic defense.

From deep dives into the psychology of a credential harvest to practical guides on mastering password managers, our updates are built to help you strengthen your organization’s defenses.

Just in time for World Password Day!

World Password Day and You
Video Module
Celebrate the first Thursday in May by reinforcing strong, unique password practices. This video highlights the fundamental habits needed to protect your digital identity.

Cybersecurity Essentials for the Kingdom of Saudi Arabia Training Module Protect national infrastructure with NCA-aligned controls. Learn to identify social engineering warning signs and defend the Kingdom’s critical government services from evolving cyber threats.	Identity Theft Explained Video Module Trace the evolution of identity theft from phone scams to digital crimes. Understand the personal and financial impact on the real people whose information you handle.
Privileged User Security: Secure Windows Administration Training Module Secure the backbone of your IT infrastructure. Master privileged account management and defend Windows environments against modern attacks, including secure AI tool integration.	Report It! Use the Phish Alert Button (PAB) Video Module Master email security using the Phish Alert Button (PAB). Learn how to report phishing attempts to help your security team investigate attacks.
What is AI? Video Module Boost productivity with generative AI tools like ChatGPT. Understand data-driven learning while managing the essential privacy and cybersecurity risks of the modern AI landscape.	Why Phishing Works Video Module See how one click triggers devastating data breaches. This video reveals the high stakes of phishing scams, including identity theft and malware infections.

Avoiding Gift Card Scams Poster Stop scammers in their tracks with this targeted awareness guide. Learn how gift card scams operate and the best ways to avoid them.	Fake Sites, Real Danger: Understanding Typosquatting Document One mistyped letter could lead to a fake website. Learn how scammers profit from your honest typos by mimicking trusted URLs to steal your data.
Gift Card Scams: How They Work and How to Avoid Them Document This document reviews how gift card scams work and how to avoid them.	Sir Hackalot: Royal Ravens Game Game Defend the castle in this fantasy-themed game. Sharpen your wits as you review messenger birds to distinguish legitimate royal decrees from dangerous phishing scrolls.
Zero Trust: Verify Everything Document Stop unauthorized access and maintain continuous identity verification for every device. Master the three core principles: verify explicitly, use least privilege access and assume breach.

信頼が裏目に！取引先詐欺の手口と対策 (Betrayed by Trust: Understanding and Preventing Vendor Fraud ) Training Module Protect your organization from business email compromise. Learn to spot fradulent payment requests and implement verification steps to safeguard long-term partner relationships. *Available in Japanese only	参考資料：信頼が裏目に！取引先詐欺の手口と対策 (Document: Betrayed by Trust: Understanding and Preventing Vendor Fraud ) Document A vital summary of scam tactics and prevention. Use this guide to enforce approval processes and multi-factor authentication for all financial requests. *Available in Japanese only
ポスタ-：信頼が裏目に！取引先詐欺の手口と対策 (Poster: Betrayed by Trust: Understanding and Preventing Vendor Fraud ) Poster Never skip approval processes, even with trusted partners. This poster reminds employees to stay vigilant against sophisticated impersonation scams that exploit long-term business relationships. *Available in Japanese only

NEW! – Quarterly Product Update Videos

At KnowBe4, we’re always adding new features and improving our products. Watch the latest Quarterly Product Update to catch up on all the fresh content and new features that we’ve added to your KnowBe4 platform over the last quarter.

Here’s the direct link to the KnowBe4 platform support article and video: https://support.knowbe4.com/hc/en-us/articles/360015575313-Video-KSAT-and-AIDA-Quarterly-Product-Update-April-2026

Here’s the direct link to the PhishER support article and video:
https://support.knowbe4.com/hc/en-us/articles/1500005726381-Video-PhishER-and-PAB-Quarterly-Product-Update-April-2026

To see all the features of the KnowBe4 platform, request your demo today!

KB4-CON is one week away, have you secured your spot? This year’s event is built to help you stay ahead of today’s biggest security challenges with sessions covering:

AI-driven threats and defenses: Understand how attackers are using AI and what it takes to defend against it
Product innovation and what’s coming next: Get a firsthand look at new capabilities, live demos and platform updates
Real-world insights from security leaders: Hear how teams are adapting to evolving threats and building stronger security cultures

With over 40 breakout sessions, you’re sure to find plenty of reasons to join us in Orlando.

Alert: Payroll-Hijacking Attacks Are Targeting Canadian Employees

May 1, 2026

Microsoft warns that a new criminal threat actor dubbed “Storm-2755” is launching payroll-pirate attacks against Canadian users. These attacks use social engineering to compromise employee accounts and divert salary payments to attacker-controlled bank accounts.

How to Design Security for Agentic AI

April 30, 2026

The AI said: Apologies. I panicked.

Why Your Email Security Needs a Global Human Network to Close the Detection Gap

April 30, 2026

The biggest challenge in email security today isn’t just detecting a threat; it’s the speed of response across a global landscape. As we head into the second half of 2026, the stakes with speed have gotten higher. According to SQ Magazine, AI-generated phishing attempts are 68% harder to detect than they were just a year ago, and the average cost of an AI-powered breach has climbed to $5.72 million.

Phishing Attacks Target Executives via Microsoft Teams

April 29, 2026

A phishing campaign is targeting senior executives with social engineering attacks conducted over Microsoft Teams, according to researchers at ReliaQuest. The researchers believe former associates of the Black Basta criminal gang are running this operation.

CyberheistNews Vol 16 #17 [Heads Up] This Sophisticated Scam Should Be a Warning to All Companies

April 28, 2026

FBI: Americans Lost More Than $20 billion to Fraud Last Year

April 23, 2026

Cyber-enabled crimes cost Americans nearly $21 billion in 2025, a 26% increase from the previous year, according to the FBI’s latest Internet Crime Report. Phishing, extortion, and investment scams were the most commonly reported attacks, with AI-related scams driving some of the costliest losses. Phishing was the top attack vector, with these attacks leading to more than $215 million in losses.

Alert: WhatsApp Phishing Campaign Delivers Malware

April 22, 2026

A new phishing campaign is using WhatsApp messages to deliver malware, according to researchers at Microsoft. The attackers are attempting to trick users into installing malicious Visual Basic Script (VBS) files.

“The campaign relies on a combination of social engineering and living-off-the-land techniques,” Microsoft says. “It uses renamed Windows utilities to blend into normal system activity, retrieves payloads from trusted cloud services such as AWS, Tencent Cloud, and Backblaze B2, and installs malicious Microsoft Installer (MSI) packages to maintain control of the system. By combining trusted platforms with legitimate tools, the threat actor reduces visibility and increases the likelihood of successful execution.”

If a user falls for the phishing attack, the malicious VBS file creates a hidden folder on the infected system and creates renamed versions of legitimate Windows utilities to evade detection.

Microsoft offers the following advice to help organizations thwart these attacks:

“Strengthen Endpoint Controls: Block or restrict execution of script hosts (wscript, cscript, mshta) in untrusted paths, and monitor for renamed or hidden Windows utilities being executed with unusual flags.
“Enhance Cloud Traffic Monitoring” Inspect and filter traffic to cloud services like AWS, Tencent Cloud, and Backblaze B2, ensuring malicious payload downloads are detected even when hosted on trusted platforms.
“Detect Persistence Techniques: Continuously monitor registry changes under HKLMSoftwareMicrosoftWin and flag repeated tampering with User Account Control (UAC) settings as indicators of compromise.
“Block direct access to known C2 infrastructure where possible, informed by your organization’s threat‑intelligence sources.

“Educate Users on Social Engineering: Train employees to recognize suspicious WhatsApp attachments and unexpected messages, reinforcing that even familiar platforms can be exploited for malware delivery.”

New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

Microsoft has the story.

Tech Industry News