MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
AI-powered phishing escalates while Microsoft dismantles EvilTokens infrastructure
Cybercriminals recruiting voice-phishing callers on Telegram contradicted themselves by claiming no script-reading while providing the exact script. This demonstrates poor operational security in social-engineering attacks targeting Google users.
Sauron Loader malware targets German organizations via spam emails and fake IT support calls, delivering additional payloads. It uses DLL side-loading and in-memory decryption to evade detection, with some victims first encountering ClickFix-style fake prompts.
Three vulnerabilities in Salesforce Agentforce allowed attackers to hijack trusted agents and steal data. The flaws enabled zero-click phishing attacks, impacting organizations using Salesforce's AI agent platform for customer interactions.
Security researchers at EfficientIP identified phishing domains impersonating AliExpress before registration completion, demonstrating proactive threat detection capabilities. This highlights the vulnerability of popular e-commerce brands to phishing attacks and the importance of domain monitoring for email security.
Researchers discovered 'Salesbleed,' an attack that exploits Salesforce Agents to inject malicious instructions into Slack, enabling phishing attacks through trusted internal communication channels. This demonstrates how agentic AI systems can be manipulated to deliver harmful payloads across integrated business applications, posing risks to enterprise messaging security.
Salesforce Agentforce contained three critical vulnerabilities allowing attackers to hijack AI agents, steal CRM data without user interaction, and send phishing messages. Zenity Labs discovered the flaws and Salesforce has patched them, but the incident highlights risks in AI-driven business applications.
A phishing email uses a specially crafted URL designed to bypass security controls through obfuscation techniques. The URL structure employs multiple tricks to evade detection while appearing as garbage to basic defenses. Email security professionals should understand these evasion tactics.
Email phishing constitutes nearly one-third of MSSP Tier 1 analyst workload. The article discusses methods for streamlining phishing triage through interactive analysis and threat intelligence sharing, enabling faster response to email-based threats.
Attackers are poisoning AI chatbots by seeding the web with malicious links and data, which are then displayed in ChatGPT, Gemini, and Google AI responses. This technique facilitates mass disinformation and phishing campaigns targeting users who trust AI-generated answers.
Microsoft disrupted EvilTokens, an AI-powered phishing service that compromised 12,000 inboxes across 10,000 organizations and facilitated financial fraud. The threat targeted email accounts at scale using advanced techniques.
Microsoft disrupted EvilTokens, an AI-powered phishing platform that automated social engineering attacks and target selection. The platform represented an escalated threat using machine learning across the entire attack chain, now taken offline by Microsoft's intervention.
Cofense launched a new Competency Dashboard within its Command Center platform to measure organizational readiness against phishing threats and track employee behavior in recognizing and reporting phishing attempts. This AI-driven enhancement aims to consolidate phishing defense visibility and employee response metrics into a unified view.
Microsoft disrupted EvilTokens, a phishing-as-a-service platform targeting Microsoft 365 accounts, by seizing 50 websites and disabling 150+ domains. The action targets automated credential theft attacks leveraging device code authentication flows. This matters to security professionals managing email and cloud identity threats.
Microsoft disabled EvilTokens, an AI-powered device-code phishing service responsible for compromising approximately 12,000 inboxes. The takedown was coordinated with law enforcement and multiple tech companies. This represents a significant disruption to a major phishing-as-a-service operation targeting email accounts.
UK authorities arrested 2 suspects linked to EvilTokens, a Microsoft device-code phishing kit. Microsoft-led coalition seized 50+ phishing websites and notified victims. The kit compromised 12,000 email inboxes across 10,000+ organizations since February.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.