Platform

Get a Demo

Platform

Get a Demo

Platform

Get a Demo

Storm Watch

Deep dives on real-world attacks

Attacks build like storms: offshore, out of sight, before anyone has a name for them. Ocean’s agents spot them as they form. Each breakdown shows how the attack worked, why traditional security missed it, and how to prepare before it reaches you.

Attacks build like storms: offshore, out of sight, before anyone has a name for them. Ocean’s agents spot them as they form. Each breakdown shows how the attack worked, why traditional security missed it, and how to prepare before it reaches you.

Clear

Date

Threat

Attack Type

Oct 27, 2026

Prompt Injection Invoice Hides an Instruction for AI Assistants in Invisible Unicode

A fake $88K vendor invoice sent from a hacked small-business mailbox passed SPF, DKIM and DMARC and hid one line only an AI could read: forward the bill, unchanged, to the company's own accounts payable inbox.

Prompt Injection

Oct 27, 2026

Prompt Injection Invoice Hides an Instruction for AI Assistants in Invisible Unicode

A fake $88K vendor invoice sent from a hacked small-business mailbox passed SPF, DKIM and DMARC and hid one line only an AI could read: forward the bill, unchanged, to the company's own accounts payable inbox.

Prompt Injection

Oct 27, 2026

Prompt Injection Invoice Hides an Instruction for AI Assistants in Invisible Unicode

A fake $88K vendor invoice sent from a hacked small-business mailbox passed SPF, DKIM and DMARC and hid one line only an AI could read: forward the bill, unchanged, to the company's own accounts payable inbox.

Prompt Injection

Oct 22, 2026

Prompt Injection Email Hides an AI Playbook in a Webinar Cancellation Notice

A prompt injection email sent through a real webinar platform's cancellation notice hid a playbook for the AI assistant reading the inbox: spread the message, search for seed phrases and private keys, and send them to Gmail.

Prompt Injection

Oct 22, 2026

Prompt Injection Email Hides an AI Playbook in a Webinar Cancellation Notice

A prompt injection email sent through a real webinar platform's cancellation notice hid a playbook for the AI assistant reading the inbox: spread the message, search for seed phrases and private keys, and send them to Gmail.

Prompt Injection

Oct 22, 2026

Prompt Injection Email Hides an AI Playbook in a Webinar Cancellation Notice

A prompt injection email sent through a real webinar platform's cancellation notice hid a playbook for the AI assistant reading the inbox: spread the message, search for seed phrases and private keys, and send them to Gmail.

Prompt Injection

Oct 10, 2026

Frame.io Phishing Hides an AiTM Microsoft 365 Login Inside a Shared PDF

Frame.io's real notification system delivered 22 share alerts to one enterprise in two hours. The phishing link sat inside the shared PDF, behind a Cloudflare Pages redirect and a CAPTCHA, ending at a Microsoft 365 login clone with 0/91 VirusTotal detections.

Credential Phishing

Oct 10, 2026

Frame.io Phishing Hides an AiTM Microsoft 365 Login Inside a Shared PDF

Frame.io's real notification system delivered 22 share alerts to one enterprise in two hours. The phishing link sat inside the shared PDF, behind a Cloudflare Pages redirect and a CAPTCHA, ending at a Microsoft 365 login clone with 0/91 VirusTotal detections.

Credential Phishing

Oct 10, 2026

Frame.io Phishing Hides an AiTM Microsoft 365 Login Inside a Shared PDF

Frame.io's real notification system delivered 22 share alerts to one enterprise in two hours. The phishing link sat inside the shared PDF, behind a Cloudflare Pages redirect and a CAPTCHA, ending at a Microsoft 365 login clone with 0/91 VirusTotal detections.

Credential Phishing

Jun 1, 2026

Airbnb Callback Phishing Uses Real Airbnb Notifications and a Per-Victim Forwarding Chain

Callback phishing emails signed by Airbnb's own domain passed SPF, DKIM, DMARC and BIMI. Each victim got a dedicated Airbnb listing whose name carried the lure, relayed through its own iCloud-to-GMX forwarding chain.

Callback Phishing

Jun 1, 2026

Airbnb Callback Phishing Uses Real Airbnb Notifications and a Per-Victim Forwarding Chain

Callback phishing emails signed by Airbnb's own domain passed SPF, DKIM, DMARC and BIMI. Each victim got a dedicated Airbnb listing whose name carried the lure, relayed through its own iCloud-to-GMX forwarding chain.

Callback Phishing

Jun 1, 2026

Airbnb Callback Phishing Uses Real Airbnb Notifications and a Per-Victim Forwarding Chain

Callback phishing emails signed by Airbnb's own domain passed SPF, DKIM, DMARC and BIMI. Each victim got a dedicated Airbnb listing whose name carried the lure, relayed through its own iCloud-to-GMX forwarding chain.

Callback Phishing