MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
A Chinese-language phishing network deployed 17,000 domains targeting Japanese banks and other brands via three phishing kits (CoGUI, CoAceV, CoFish_Ws) to steal credentials through deceptive emails and fake login pages. Microsoft and law enforcement partners disrupted portions of the operation.
A Chinese-run phishing network using the Iron Man System platform sent approximately 1 billion phishing emails targeting 75,000 organizations. The operation leveraged a paid phishing-as-a-service platform to deploy fake websites and steal credentials. This represents a massive coordinated campaign directly impacting email security.
Microsoft and Health-ISAC seized domains hosting YAM Store and related phishing kits responsible for over 1 billion malicious messages. These services facilitated large-scale phishing and email attack infrastructure, directly impacting email security defenses.
Microsoft disrupted a global phishing network linked to Yam Store marketplace that was behind over one billion phishing messages targeting victims. The operation highlights the scale of organized phishing infrastructure. Email security professionals should track this network's reconstruction efforts.
Yam Store, a cybercrime marketplace, supplied cloud infrastructure and phishing kits enabling over 1 billion phishing messages globally. This network represents a significant threat to email security professionals defending against large-scale phishing campaigns.
Microsoft and partners disrupted three major phishing kits (CoGUI, Haozi, Iron Man System) linked to over 1 billion scam messages since January 2026. The takedown involved Health-ISAC, JC3, Cloudflare, Oracle, Proofpoint, and others targeting threat actors using these platforms for large-scale phishing campaigns.
Microsoft seized domains for three phishing platforms (YAM Store, CoGUI, Iron Man) used by Chinese cybercriminals in coordination with Japanese police and Health-ISAC. The takedown disrupted infrastructure supporting active phishing campaigns.
Microsoft and Health-ISAC, backed by federal court order, seized domains operating YAM Store, CoGUI, and Iron Man—platforms behind over 1 billion phishing messages. This disruption targets Chinese-language phishing infrastructure used for large-scale credential theft campaigns.
Microsoft and partners disrupted a major Chinese-language phishing kit ecosystem operated by Storm-2990, which delivered over 1 billion phishing emails and SMS messages to 75,000+ targets since early this year. The coordinated takedown involved Japanese authorities and multiple cybersecurity firms targeting customized phishing kits sold by Chinese-speaking threat actors.
North Korea is conducting phishing campaigns targeting Ukrainians to gather military intelligence using reply-baiting techniques. This represents an active, state-sponsored threat leveraging email to compromise sensitive war-related information from Ukrainian forces.
Ontinue's H1 2026 threat report reveals rising attacks exploiting Microsoft Teams, npm packages, device-code authentication, and ClickFix malware. These attack vectors are increasingly used by threat actors for phishing, malware distribution, and credential theft targeting organizations.
Cofense detected phishing emails disguised as event invitations that trick users into installing Remote Access Trojans (RATs). Attackers exploit trust and curiosity by using legitimate-looking calendar invites with malicious URLs redirecting to fake event pages. This poses significant risk to email users and organizations.
Researchers discovered that two characters in Chromium browsers enable typosquatters and phishers to create lookalike URLs appearing as legitimate domains. This technique exploits newly available characters in browser rendering, creating phishing opportunities similar to traditional typosquatting attacks.
The FBI and DOJ disrupted scanning and spear-phishing tools used by Flax Typhoon, a Chinese state-sponsored hacking group. The seizure targeted infrastructure used for reconnaissance and phishing campaigns. This matters as Flax Typhoon targets critical infrastructure with sophisticated social engineering techniques.
Article discusses phishing's prevalence and evolution, noting FBI data shows phishing accounts for 26% of cybercrime complaints. It explores how generative AI is being used both offensively in phishing campaigns and defensively in email security solutions.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.