MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
North Korean Kimsuky group deployed offline AI systems to enhance phishing campaigns and automate malware development, reducing reliance on public chatbots and leveraging stolen documents for espionage operations.
Researchers discovered three attack methods bypassing passkey protections: exploiting Windows authentication material exposure, abusing cloud-synced passkeys via malware, and using phishing-resistant MFA workarounds. Passkeys are increasingly used for email account protection, making these attacks directly relevant to email security practitioners.
UNC6671, a data extortion group, conducts vishing attacks on personal phones impersonating IT staff to trick enterprise employees into compromising SaaS credentials. The campaign targets financial services, private equity, and professional services sectors, bypassing traditional email security controls.
Researchers discovered an active phishing campaign using adversary-in-the-middle techniques to compromise Microsoft 365 accounts and extract payroll and finance emails. Attackers use residential proxies to mask malicious sign-ins, targeting financial personnel.
Kali365 phishing kit exploits Microsoft authentication to target US companies. Attackers trick users into approving device codes on legitimate Microsoft pages, stealing access tokens to compromise email, documents, and cloud resources.
Greatness PhaaS now supports device code phishing to bypass MFA and steal OAuth tokens. This technique abuses legitimate OAuth 2.0 Device Authorization Grant flows. Critical threat for organizations as attackers can compromise accounts despite MFA protections.
HollowFrame loader and Matryoshka backdoor were deployed via spear-phishing targeting a law firm. The attack chain began with a phishing email containing a link to an encrypted archive with a malicious LNK file. This undocumented Go and Rust malware represents a sophisticated multi-stage threat.
Device code phishing exploits OAuth 2.0 device authorization flows to steal access tokens at scale. Originally a red-team technique, it has become a widespread threat affecting various applications beyond input-constrained devices, posing significant risks to credential security and account access.
Operation BlueDash uses fake Microsoft Teams update lures to trick users into downloading legitimate RMM tools (Level and ScreenConnect), establishing remote access for potential credential harvesting or system compromise. This phishing campaign targets Teams users via compromised infrastructure and counterfeit Store pages.
Cruciferra, a sophisticated crypter service, hides Windows malware using BYOVD and process ghosting techniques. The China-linked group uses it for tax-related phishing campaigns targeting Indian taxpayers and finance teams. The tool enables malware delivery while evading detection.
Insurance phishing attacks have evolved from credential harvesting to real-time account hijacking, with attackers immediately compromising accounts during phishing sessions rather than storing credentials for later use. This represents a significant shift in attack tactics targeting financial institutions and insurance firms.
North Korean threat actor BlueNoroff operates a phishing kit impersonating Zoom and Microsoft Teams to deliver malware. The campaign profiles cryptocurrency wallets before malware delivery, exploiting typosquatted domains to compromise targets through social engineering.
A critical vulnerability in ChatGPT Workspace Agents (AgentForger) could allow attackers to deploy rogue AI agents via phishing links. The flaw enabled building and authorizing autonomous agents within victim organizations. OpenAI patched the issue as of June 8.
German and US law enforcement dismantled Kratos, a major phishing kit designed to steal Microsoft 365 sessions and bypass MFA. An Indonesian developer was arrested. This takedown disrupts a widely-used criminal tool targeting email accounts globally.
Researchers at Rapid7 discovered an exposed server containing an AI-assisted phishing toolkit used in active malware campaigns. The toolkit, which includes lure templates and malware builders, was being deployed against Windows users in Mexico via WebDAV to deliver infostealers through spoofed government websites.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.