Netskope Threat Protection

Curious if anyone has successfully triggered compromised credential alerts in recent months.We've noticed that there have been no detections of compromised credentials for several months. We've reached out to support and the L3 team, but no test samples have been provided to demonstrate the functionality in the console.We're wondering if anyone has observed any related events that could confirm this feature is functioning as expected.

The Netskope Threat Labs Report: Europe 2025 is out and available at:https://www.netskope.com/netskope-threat-labs/threat-labs-report-europe-2025The main findings can be summarized in:🌩️ 16% of malware downloads came from GitHub🌩️ Adobe is the most impersonated brand for phishing with 29%🌩️ 57% of DLP violations concern regulated data🌩️ 91% of organizations use GenAI appsThe following infographic summarizes the main findings: 

Table of ContentsIntroduction How a Reverse Proxy Phishing Kit Works Mitigation Strategy 1: Conditional Access on the Target Application Mitigation Strategy 2: Remote Browser Isolation Mitigation Strategy 3: DLP Profile Conclusion IntroductionAn emerging trend in the threat landscape is the growing availability of phishing tools that act as man-in-the-middle proxies (also known as AiTM - Attacker in The Middlle), allowing attackers to intercept login credentials and session cookies, thereby bypassing two-factor authentication (2FA) protections. Originally designed for penetration testing, they have evolved into a popular method for cybercriminals to execute phishing attacks.Common examples of phishing kits include Evilginx2.The challenge with phishing kits acting as man-in-the-middle proxies resides on the fact they they are completely transparent to users and to security tools as well. There is no real difference between the phishing page and the real login page, and additionally ther

Policy:Enable - Test Netskope IPS Description:In this video we show how to activate Netskope IPS and perform the detection test with an EICAR test file Video:Leandro Timotio de LimaCustomer Success ManagerLinkedin 

One of the advantages of exploiting a cloud service to host the attack infrastructure, is that the threat actors can use either a legitimate compromised account or create a new one specifically for their malicious purposes. According to researchers at Microsoft, this modus operandi has been used by APT33 (also known as “Peach Sandstorm”) - a threat actor believed to operate on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC)  - in their latest campaign, tracked between April and July 2024 and targeting organizations in the education, satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the United Arab Emirates. This campaign is characterized by a really interesting attack chain: the threat actors used LinkedIn to gather intelligence on their targets. From there, they launched password-spraying attacks to break into their victims’ accounts and

Netskope Global Technical Success (GTS)KB - ‘Patient Zero’ Real-time Protection Policy(Netskope Cloud Sandboxing) ObjectiveUnderstanding the Significance of Patient Zero in Cybersecurity: Building a Robust Defense via Netskope Prerequisite.Netskope Advanced Threat Protection license is required. ContextThis article explores the significance of Patient Zero events, emphasizing the need to take it seriously in cybersecurity defense strategies. It outlines creating a Real-time policy to mitigate Patient Zero events and provides insights into addressing common queries associated with Patient Zero events Reference https://docs.netskope.com/en/netskope-help/data-security/threat-protection/creating-a-threat-protection-policy-for-patient-zero/ Do you know?Before we proceed, let me address some foundational questions: What is Patient Zero?"Patient Zero" typically refers to the initial infection or point of entry in a cyber attack scenario. It represents the first victim or system to be compromi

One of the most important lines of defense in the Netskope Platform is the Threat Protection Engine. In the coming weeks, we will take a closer look under the hood and explore together how Netskope makes life difficult for attackers. One piece of the advanced multilayered threat protection is a module, based on classic threat intel feeds.  But which feeds are used and can customers customize or enrich them themselves? Netskope uses a wide range of threat intelligence feeds, both open source and commercial throughout our products.  These include various forms ranging from network and file indicators, to rules and signatures. Since our sources may change frequently, we don't publish a publicly available list.Netskope uses several own, best-of-breed open-source and paid threat feeds including MalwarePatrol (multiple feeds including phishing, C2, NRD, DGA), VirusTotal (multiple feeds), Webroot, Cisco Talos, Bitdefender, Reversing Labs, OpenPhish, PhishTank, VxVault, AIS/CISA, and many othe

NETSKOPE THREAT LABS Evil Ant, Azorult, and Segmented Threat Reports Evil Ant Ransomware Evil Ant is a new Python-based ransomware with a hardcoded key, which makes recovering files without paying the ransom possible. An Evasive Azorult Campaign Netskope Threat Labs uncovered a new Azorult campaign using HTML smuggling, reflexive code loading, and AMSI bypass to try to evade detection while stealing crypto wallets, login credentials, browser files, and important documents.Segmented Threat ReportsNetskope Threat Labs has published five new region-specific and industry-specific threat reports.Canada Japan Financial Services Healthcare Retail Anyone can subscribe to this mailing list on the Netskope Threat Labs page: https://www.netskope.com/netskope-threat-labs#subscribe

As we do every month, we have published the Threat Labs Statistics for February 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries and the return of GitHub to the top three. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware. In February, 49% of all malware downloads originated from a record-setting 215 distinct cloud apps. The top malware families active in February included the banking trojan Grandoreiro, the RAT AdWind, and the ransomware Lockbit. Cloud Malware Delivery Attackers attempt to fly under the radar by delivering malic

As we do every month, we have published the Threat Labs Statistics for January 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and SharePoint were again in the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 49% of all malware downloads in January originating from 178 cloud apps. A wide variety of malware families were circulating in January. Malware families including the Infostealer AgentTesla, the RAT AdWind, and the ransomware Lockbit and Trigona were among top families. Cloud Malware Delivery Attackers attempt to fly under the rad

Another monthly Netskope Threat Labs report. This edition is dedicated to healthcare. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the healthcare sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Although Microsoft OneDrive is the most popular app in the healthcare sector, its popularity lags behind that of other industries. The popularity of other Microsoft products was mixed, with SharePoint similarly lagging other industries but Teams leading other industries.Cloud App Abuse: Microsoft OneDrive was also the most popular app for malware downloads but lagged behind other industries, underscoring that successful malware delivery depends on both adversary tactics and user behavior.Malware & Ransomware: Among the most prevalent malware families targeting victims

The first Netskope Threat Labs report of 2024 is dedicated to financial service. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Microsoft OneDrive, Microsoft Teams, and SharePoint are among the top five most popular apps in the financial services sector, with Microsoft Teams being significantly more popular than it is in other industries. As in other sectors, Microsoft OneDrive still takes the top spot.Cloud App Abuse: OneDrive, Github, and SharePoint are the top three most popular apps for malware downloads in the financial services sector. Users in financial services download malware from GitHub and Microsoft SharePoint more frequently than users in other industries.Malware & Ransomware: A

Public version, available here.By Tom ClareNetskope continues to advance inline threat protection capabilities and has improved its detection and blocking of malware and phishing attacks while also lowering and improving its false positive rate in the latest AV-TEST Report. In every part of the testing, Netskope improved.Today more than half of user egress traffic involves applications and cloud services rather than websites, and where more than half of threats are delivered knowing these popular domains are allowed, or worse yet bypassed from inline threat inspection altogether. Relying on endpoint protection for executable malware leaves a blind spot for fileless attacks using fake login forms and phishing techniques hosted in applications and cloud services that require inline content and context inspection to protect users. This dynamic changes the playing field for threat protection testing and what must be prioritized with respect to detection speed and efficacy scores.First, use

This section of the forum is dedicated to the Netskope Threat Protection technology. In this section you will find configuration guides, reports, research documents, and in general a space where you can submit questions and be informed about the multiple features of our threat protection capabilities, including Behavior Analytics (UEBA) and Remote Browser Isolation (RBI).Everything You Always Wanted to Know About Threat Protection* But Were Afraid to Ask!Useful resources: Netskope Threat Labs Homepage Cloud and Threat Reports (published on a quarterly basis and focused on a specific topic) Threat Labs Reports (published on a monthly basis and focused on a specific topic, or a specific geographical region) Upcoming Events Recent Blog Posts (contains the links to the Netskope Threat Labs statistics published on a monthly basis)

The is first Netskope Threat Labs report of 2024 dedicated to a specific geographical region. A public version of the same report is available here.The Netskope Threat Labs Report highlights a different segment every month. This report series aims to provide strategic, actionable intelligence on active threats against users in each segment. The segment highlighted in this report is users working in Canada. In This Report Cloud App Adoption: Microsoft OneDrive, the most popular app worldwide, is even more popular in Canada than in other parts of the world, with the rest of the Microsoft 365 ecosystem following a similar trend.Cloud App Abuse: More than half of all malware downloads in Canada come from cloud apps, with a significant percentage coming from Microsoft OneDrive and GitHub.Malware & Ransomware: Among the most prevalent malware families targeting victims in Canada are the remote access Trojan NjRat, the Trojan Formbook, and the infostealer AgentTesla. Cloud App Adoption Th