MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
Phishing attacks targeted Facebook users with fake verification offers and a compromised chatbot to steal sensitive information from business accounts. Attackers impersonated legitimate verification processes to compromise credentials and data.
Chinese-linked hackers targeted Indian taxpayers using spear-phishing emails impersonating the Income Tax Department to deliver DcRAT malware. The multi-stage campaign, named Operation DragonReturn, aimed to steal sensitive data from victims' systems via a fake tax filing utility.
Researchers discovered Avalon, a modular malware framework delivered via multi-stage phishing that bundles credential theft, lateral movement, and CrownX ransomware. It bypasses traditional security controls and poses a significant threat to organizations using email as an initial attack vector.
ARToken, a phishing-as-a-service platform affiliated with EvilTokens, was exposed offering a comprehensive Microsoft 365 phishing toolkit. The discovery reveals the scope of commercially available phishing infrastructure targeting enterprise email systems, critical for defenders monitoring active threats.
Cybercriminals impersonate Interpol in phishing emails to distribute ransomware to businesses globally. This attack leverages authority spoofing to increase email credibility and infiltration success rates against organizational targets.
EvilTokens device-code phishing kit bypasses MFA and authenticates to Microsoft 365 as victims. Cisco Talos revealed new evasion techniques and capabilities, highlighting the threat's sophistication to email security professionals managing organizational defense.
Phishing campaigns now auto-adapt payloads based on victim device fingerprinting via user-agent data, delivering OS-specific malware to increase compromise rates and profitability. This technique enhances attacker effectiveness against email targets.
A new malware chain called VEIL#DROP uses Blogger platform and social engineering to deliver PureLogs stealer. Initial payloads distributed via spear-phishing or drive-by download attacks to compromise victims and steal information.
A webinar discussing how modern phishing, BEC, and account takeover attacks bypass traditional email security by exploiting trusted identities and workflows. The presentation covers behavioral AI solutions for automated detection and response.
Ousaban, a Brazilian banking trojan, targets Iberian bank users via phishing PDFs disguised as corrupted files. The malware verifies victim location in Spain/Portugal before deploying payload hidden in images to steal banking credentials.
Criminal IP integration enriches OpenCTI threat indicators with risk scoring, infrastructure intelligence, and phishing analysis to improve threat intelligence context and usability for security teams.
Brazilian banking trojan Ousaban is actively targeting Spain and Portugal through phishing campaigns. FortiGuard has identified the threat, which uses email as a delivery vector to compromise financial accounts in the region.
Researchers discovered ARToken, a business email compromise-as-a-service platform affiliated with EvilTokens phishing operation. The toolkit is designed to bypass MFA and compromise Microsoft 365 accounts, representing an advanced threat targeting organizations.
Attackers are registering fake domains that LLMs hallucinate and suggest to users, then hosting phishing pages to capture traffic. This "phantom squatting" technique exploits AI's tendency to invent non-existent URLs, creating new phishing vectors that email users may encounter.
A phishing campaign targeting MetaMask cryptocurrency wallet users was detected. The attack uses alternative authentication methods instead of traditional credential theft, demonstrating evolving phishing tactics that security professionals should recognize.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.