MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
North Korean Lazarus hackers are using post-quantum encryption in Operation FlashHole to conceal malware payloads from security tools in campaigns targeting South Korean organizations. The attack combines phishing with modern cryptography to evade detection of command-and-control communications.
SafePay ransomware gang claims over 600 victims since 2024, using password guessing, vulnerability exploitation, and phishing attacks to target businesses and critical infrastructure, according to FBI and international cyber agencies.
Attackers leverage generative AI to create custom malware and obfuscate phishing messages, overwhelming signature-based detection systems. This accelerates ransomware attacks from initial compromise to encryption. Traditional security rules become less effective against rapidly generated, unfamiliar code variants.
CikaBika Bot is a remote access trojan delivered via phishing that leverages Discord for command-and-control communications. It provides reconnaissance, remote execution, and data exfiltration capabilities, posing a threat to users compromised through phishing emails.
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise malicious traffic as email services to evade detection. Threat actors impersonate legitimate email security tools and processes, exploiting naming conventions as a defense evasion tactic.
RATHat Android malware leverages Gemini AI to control infected phones while evading normal permission restrictions. Distributed via malicious ads and phishing SMS, it exploits Accessibility features to establish persistent command channels targeting users in Europe, Latin America, and Southeast Asia.
Sauron Loader malware targets German organizations via spam emails and fake IT support calls, delivering additional payloads. It uses DLL side-loading and in-memory decryption to evade detection, with some victims first encountering ClickFix-style fake prompts.
A sophisticated ransomware group employs double-extortion tactics globally, infiltrating networks to encrypt data and threaten public disclosure of stolen information. The article examines ransomware attack methods and their impact on critical business systems across industries.
RatHat Android malware steals banking PINs and credentials through fake screens, persists after deletion, and spreads via SMS phishing and malicious ads. It targets banking customers with account takeover and payment fraud risks.
Attackers are exploiting compromised ScreenConnect clients to distribute a four-stage VBScript malware payload to newly connected systems. Initial compromise vectors include tech-support scams, phishing emails with MSI installers, and fake applications. This affects organizations using ScreenConnect and represents a significant supply-chain-like threat via remote access software.
JSCeal, a sophisticated JavaScript malware, can steal session cookies to bypass Google Authentication and conduct surveillance. It features credential harvesting, traffic interception, and multiple obfuscation techniques. This poses significant risk to email users and organizations relying on email-based authentication.
Attackers are exploiting ScreenConnect remote-access software to distribute worm-like malware across Windows networks via social engineering and phishing. Infected systems can spread payloads to connected machines without requiring individual phishing lures per victim, significantly expanding attack impact.
Law enforcement and CrowdStrike disrupted the 23-year-old Sality peer-to-peer botnet affecting 15,000+ machines worldwide. The botnet distributed malware enabling credential theft, spam, proxying, and DDoS attacks. This takedown protects organizations from ongoing malware delivery and credential compromise risks.
Cybercriminals disguise malware as a Google Gemini installer to distribute Vidar stealer, targeting saved browser passwords and credentials. The attack exploits routine software searches rather than email phishing, demonstrating credential-theft risks from trojanized downloads.
Russian state-sponsored attackers have exploited a Zimbra vulnerability for over a year, infecting targets automatically when viewing emails—without requiring clicks or file downloads. The campaign, attributed to Laundry Bear, affected government and commercial networks across the US, UK, and allies since July 2025.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.