Skip to main content
Author

Max Gannon

Intelligence Analysis Manager

Max Gannon is the Intelligence Analysis Manager at Cofense, where he leads a team focused on producing tactical and strategic intelligence on phishing threats. He oversees the analysis of threat actor tactics, techniques, and procedures (TTPs), as well as the motivations behind threat actor actions, helping to drive innovation in phishing detection, investigation, and response. His expertise spans phishing analysis, malware analysis, and open-source intelligence. At Cofense, he has played a key role in developing advanced malware analysis techniques and continues to serve as a subject matter expert in credential phishing and malware delivery. His commentary and work have been covered in Forbes, The CyberWire, and many other media outlets.

Articles By

Max Gannon

4 posts

{{articles.featured.category.label}}
July 1, 2026

The Platform You Trust Is the Platform They Target

Cofense Intelligence is observing a clear shift in phishing operations: threat actors are moving beyond broad, one-size-fits-all campaigns and adopting platform-aware delivery that adapts to the victim’s device, browser, and environment. What began as simple Windows-focused malware distribution campaigns has evolved into more sophisticated campaigns that can selectively deliver credential phishing, remote access tools, or malware across Windows, MacOS, and Android. This trend reflects a broader strategic change in the threat landscape, one that is designed to increase the likelihood of compromise, expand target coverage, and improve threat actor return on investment.

February 11, 2026

Mispadu Phishing Malware Baseline: Delivery Chains, Capabilities, and Common Campaigns

Mispadu is a rapidly evolving banking trojan that has become the most prevalent Latin American threat observed by Cofense, using phishing emails that routinely bypass secure email gateways. This analysis breaks down how Mispadu campaigns rely on deceptive PDF attachments and multi-stage delivery chains to deploy obfuscated malware using legitimate tools.

January 14, 2026

International Threats: How Malware Campaigns Vary Across Non-English Languages

This report examines malware families delivered by campaigns that bypass secure email gateways between May 2023 and May 2025, focusing on the five most common non-English languages used to deliver malware. It highlights long-term trends to help organizations understand whether they are more likely to face regionally targeted malware or more generalized threats, as part of a broader series on multilingual phishing campaign trends.

January 7, 2026

International Threats: Themes for Regional Phishing Campaigns

Cofense Intelligence relies on over 35 million trained employees from around the world, therefore a considerable number of analyzed campaigns are written in languages other than English. This report covers from May 2023 to May 2025 and focuses on the overall themes of campaigns in the top five most commonly seen languages besides English that bypassed perimeter filtering such as Secure Email Gateways (SEGs).