MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
A misconfigured public web server exposed an active Evilginx phishing operation targeting Microsoft 365, revealing the attacker's toolkit and leading to discovery of two additional related operations. This demonstrates how poor operational security compromises sophisticated phishing infrastructure.
Attackers distribute malicious Windows shortcuts via spam emails disguised as booking confirmations. Clicking the LNK file triggers PowerShell and Node.js to install a backdoor, enabling remote code execution and further system compromise.
Okta reports vishing attacks targeting Microsoft 365 customers, with attackers using phone calls to direct victims to fake Microsoft Entra ID login pages. This phishing technique aims to steal credentials from a widely-used enterprise authentication system.
Attackers are using fake Microsoft Entra passkey enrollment prompts via voice-based phishing to compromise Microsoft 365 accounts across multiple sectors. The threat actor O-UNC-066 deploys a panel-controlled phishing kit targeting passkey enrollment, leading to data extortion attacks.
Security researchers identified a phishing technique using HTML comment stuffing to evade AI-based email detection systems. This method obscures phishing content within HTML comments, representing an evolving evasion tactic that email security professionals should monitor for detection bypass attempts.
Threat group UNC066 has exploited Microsoft Entra passkey enrollment through phone-based phishing since April 2026, tricking employees into registering attacker-controlled passkeys to hijack enterprise accounts. The campaign combines social engineering with custom phishing kits targeting corporate credentials.
UNC6692 threat group uses Microsoft Teams impersonation in spam emails to trick victims into installing SNOW malware. Attackers pose as IT helpdesk staff, exploiting social engineering and trust in familiar tools to gain machine control. This campaign targets organizations via email-based initial contact.
Kaspersky reports that Armored Likho APT group is targeting government and energy sectors using BusySnake Stealer malware, AI-generated loaders, and phishing attacks. This represents an advanced threat combining information-stealing capabilities with sophisticated delivery mechanisms against critical infrastructure.
A webinar discussing the limitations of email-layer defenses against modern phishing attacks. It addresses why organizations struggle to prevent phishing and suggests need for broader security approaches beyond traditional email filtering.
A new 'ghost phishing' technique in the EvilTokens campaign hides malicious pages until decryption in the victim's browser, bypassing traditional email security URL checks. Targets US and Europe businesses seeking Microsoft 365 access and sensitive data.
A phishing campaign impersonating job opportunities from major brands targets marketing professionals to steal their Google account credentials using nested redirects and evasion techniques.
DEBULL tooling abuses Microsoft's legitimate device-code flow in a phishing campaign targeting M365 accounts using collaboration-themed lures, exploiting the device login process to compromise victim credentials without fake login pages.
Cybercriminals impersonate IT support via Microsoft Teams to trick employees into installing EtherRAT malware. Attacks begin with phishing emails posing as employee surveys, followed by Teams calls requesting remote access. This targets organizations broadly through a multi-stage social engineering campaign.
Google is suing Chinese scammers operating Outsider Enterprise, a phishing-as-a-service operation on Telegram that helps non-technical users create fraudulent websites mimicking Google, YouTube, and government agencies using Gemini AI. This represents Google's enforcement action against organized phishing infrastructure.
Article compares four leading email security solutions featuring AI threat detection, phishing defense, malware blocking, and DLP capabilities designed to protect employee inboxes from email-borne threats.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.