To say 2026 has been a big year for us would be an understatement — it's been a HUGE year for us! And we're shouting it from the @Nasdaq Tower. 🗣️👏 bit.ly/3VWWDzE

"It happened before they even emailed me—it was already done." 🤖⚡ See how the @CityDaytona instantly neutralize email threats across all mailboxes and keep their Risk Score at 3.3%. bit.ly/3VmdJ9U

Episode 1 of Attempted Intelligence is officially LIVE! 🚨 What actually makes something an AI agent? What is shadow AI? And how do you avoid generating AI slop at work? Our AI experts break it all down in plain English. bit.ly/4j50CDN

The Rise of Legitimate-Service Phishing: 1 in 10 Phishing Emails Now Comes From a Platform You Trust blog.knowbe4.com/the-rise-of…

Deepfake training has a blind spot 👀 Spotting a fake is easy when you know it's a test. Real attacks don't announce themselves. Watch Perry Carpenter of KnowBe4 break it down, then tell us: what's the last fake that almost got you? #deepfakes #infosec #solvewithVIA

Fresh threats require fresh training 🚀 Check out what went live in September! Elevate your security program with new modules on zero trust, AI ethics, MFA and insider threats, and more. Preview the releases. ⬇️ bit.ly/4783f0l

See how @VaFarmBureau uses PhishER Plus to organize its “junk drawer” inbox and remove email threats across the organization. Learn more. bit.ly/4drW0nv

Our Q3 wins reflect: Our commitment to securing the whole workforce, upholding an excellent customer experience and dedication to our employees. bit.ly/4ziPgke

Not the research labs. Not the news cycle. Just real people making AI work... at work. 💼 Attempted Intelligence—a weekly podcast hosted by Harlan Parrott & Matthew Duren—drops next week! Subscribe now. bit.ly/4j50CDN

Many Brands, One Kit: How Shared Infrastructure Ties Together a Sprawling Phishing Campaign KnowBe4 ThreatLabs is tracking an evolving phishing campaign that keeps changing its brand skin but never its underlying kit. In mid-September 2026, it started as cPanel mail-quota notifications, then pivoted to spoofed Microsoft and Dell delivery-failure alerts, and most recently to fake QuickBooks payment notices with the same structure, same click-tracking layer, new branding and copy every few days. HOW IT WORKS: The Lure: Each wave swaps the brand and pretends a mail-quota warning, a failed delivery, an unpaid invoice but reuses the same email template underneath. The Link: Every lure’s call-to-action routes through a compromised domain dressed up as a marketing-platform click-tracking link (the CL0/ path resembles a Constant Contact–style tracking format), which then redirects to a parked domain or a hijacked site harvesting M365 credentials. WHY IT MATTERS: On the surface, these domains have nothing in common. Underneath, three signals tie them to the same operator: Shared IP: send.smnambijabajo[.]com and cp.preparationguru[.]com both resolve to 209.94.57[.]48. Shared Certificate History : preparationguru[.]com a domain with a TLS certificate history dating to 2018, since re-registered and repurposed shares certificates with five newly surfaced domains, tying all six to the same hosting account. Naming Pattern: the click-tracking subdomains all follow the same convention — links, click, clicks, clickxs. WHAT DEFENDERS SHOULD DO: Block the shared IP and hunt your logs for subdomains matching links|click|clicks|clickxs. A shared certificate or IP is often the fastest way to burn an entire multi-brand operation in one move, instead of chasing each lure individually. #Phishing #ThreatIntel #KnowBe4ThreatLabs #CyberSecurity #InfrastructureAnalysis #M365 #CredentialHarvesting #InfoSec

The G2 Fall 2026 Grid Reports are live — and our leader status is intact. 🏆 ✅ #1 leader for Security Awareness Training (SAT) ✅ A leader for Incident Response See more about this recognition. bit.ly/3Vi8d85

Our Agent Risk Manager and Claude's Compliance API integration gives security teams visibility into Claude activity across the organization. Available to select customers now. bit.ly/4dYo7uD

Managing security awareness training just got much simpler 🚀 We’ve launched KnowBe4 for Workday Learning! Now you can sync KnowBe4 training directly into Workday, automate real-time completion tracking, and eliminate manual record reconciliation. More: bit.ly/4rAXPV5

Are Your AI Assistants the Next Attack Surface? blog.knowbe4.com/are-your-ai…

Shadow AI is one of the hardest risks for security teams to contain. Our new browser extension addresses this head on, giving teams the ability to allow, warn or block unsanctioned AI access in real time. Learn more about Agent Risk Manager’s expansion. bit.ly/4xAQ2YD

Use the final days of September to build your plan for Cybersecurity Awareness Month. A mission fortunately made less than impossible with our resource kit. Download it today. 🕵️ bit.ly/4yBs6VW

Agentic malware is a reality in today's threat landscape. Cybercriminals use LLMs to automate specialized attacks at scale. Meanwhile, unmonitored shadow AI creates hidden risks inside your network. CISO Advisor Dr. Martin Kraemer explains how to secure your enterprise. 👇

Fresh content alert! 🎬 We dropped 44 new releases in August — including new modules on AI threats, supply chain attacks and accessibility! Hit play to check out what's new in the KnowBe4 ModStore. 👇 bit.ly/4xg3HEo

Put your intel to the test — check your knowledge of our Cybersecurity Awareness Month Resource Kit and download it now. 🔍 bit.ly/3SxMTKV

Why do security teams tolerate unpredictable AI agents while blaming humans for the same kind of mistakes? 🚨 CISO Advisor Dr. Martin Kraemer challenges CISOs to protect the entire digital workforce under one unified framework.