MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
DEBULL tooling abuses Microsoft's legitimate device-code flow in a phishing campaign targeting M365 accounts using collaboration-themed lures, exploiting the device login process to compromise victim credentials without fake login pages.
Cybercriminals impersonate IT support via Microsoft Teams to trick employees into installing EtherRAT malware. Attacks begin with phishing emails posing as employee surveys, followed by Teams calls requesting remote access. This targets organizations broadly through a multi-stage social engineering campaign.
Google is suing Chinese scammers operating Outsider Enterprise, a phishing-as-a-service operation on Telegram that helps non-technical users create fraudulent websites mimicking Google, YouTube, and government agencies using Gemini AI. This represents Google's enforcement action against organized phishing infrastructure.
Article compares four leading email security solutions featuring AI threat detection, phishing defense, malware blocking, and DLP capabilities designed to protect employee inboxes from email-borne threats.
Phishing attacks targeted Facebook users with fake verification offers and a compromised chatbot to steal sensitive information from business accounts. Attackers impersonated legitimate verification processes to compromise credentials and data.
Chinese-linked hackers targeted Indian taxpayers using spear-phishing emails impersonating the Income Tax Department to deliver DcRAT malware. The multi-stage campaign, named Operation DragonReturn, aimed to steal sensitive data from victims' systems via a fake tax filing utility.
Researchers discovered Avalon, a modular malware framework delivered via multi-stage phishing that bundles credential theft, lateral movement, and CrownX ransomware. It bypasses traditional security controls and poses a significant threat to organizations using email as an initial attack vector.
ARToken, a phishing-as-a-service platform affiliated with EvilTokens, was exposed offering a comprehensive Microsoft 365 phishing toolkit. The discovery reveals the scope of commercially available phishing infrastructure targeting enterprise email systems, critical for defenders monitoring active threats.
Cybercriminals impersonate Interpol in phishing emails to distribute ransomware to businesses globally. This attack leverages authority spoofing to increase email credibility and infiltration success rates against organizational targets.
EvilTokens device-code phishing kit bypasses MFA and authenticates to Microsoft 365 as victims. Cisco Talos revealed new evasion techniques and capabilities, highlighting the threat's sophistication to email security professionals managing organizational defense.
Phishing campaigns now auto-adapt payloads based on victim device fingerprinting via user-agent data, delivering OS-specific malware to increase compromise rates and profitability. This technique enhances attacker effectiveness against email targets.
A new malware chain called VEIL#DROP uses Blogger platform and social engineering to deliver PureLogs stealer. Initial payloads distributed via spear-phishing or drive-by download attacks to compromise victims and steal information.
A webinar discussing how modern phishing, BEC, and account takeover attacks bypass traditional email security by exploiting trusted identities and workflows. The presentation covers behavioral AI solutions for automated detection and response.
Ousaban, a Brazilian banking trojan, targets Iberian bank users via phishing PDFs disguised as corrupted files. The malware verifies victim location in Spain/Portugal before deploying payload hidden in images to steal banking credentials.
Criminal IP integration enriches OpenCTI threat indicators with risk scoring, infrastructure intelligence, and phishing analysis to improve threat intelligence context and usability for security teams.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.