MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
KnowBe4 researchers identified a phishing campaign exploiting Microsoft 365's Direct Send feature to deliver malicious emails, with attackers timing submissions during US Eastern business hours to maximize impact and detection evasion.
Phishing emails impersonating sexual misconduct allegations target universities, delivering fake Google Drive links that install Zoho RAT malware. Healthcare-linked institutions are primary targets. This demonstrates email's continued role as the primary attack vector for malware distribution.
Hackers compromised Brevo marketing platform and sent phishing emails to 347,000 Trezor users plus customers of BitBox and CoinTracking. The attack exploited a third-party service to distribute credential-theft emails targeting cryptocurrency users.
ThreatsDay roundup covers 200 Android flaws, browser-based phishing techniques, 119K scam shops, and other security incidents. Multiple stories highlight systemic failures where excessive permissions, trusted services exploited for phishing, and unpatched vulnerabilities enable attacks. Relevant to email security professionals monitoring phishing infrastructure and malware delivery mechanisms.
Attackers use Blob URLs and Microsoft Teams to host phishing pages directly in victims' browsers, evading detection. Campaigns begin with DocuSign-themed emails containing malicious calendar invitations that redirect through Microsoft OAuth and Teams endpoints, making the attack appear legitimate while bypassing security inspections.
Hackers are using passkey-themed phishing emails and social engineering to compromise Microsoft 365 accounts, bypassing MFA protections. Attackers pose as IT support via calls and texts, directing victims to fake sign-in pages. Compromised accounts facilitate further cloud data theft and Teams-based lure distribution.
Threat actors leveraged Claude and GPT tools to streamline attacks on government, financial, and transport networks in Latin America. The attacks combined AI-assisted techniques with conventional methods like phishing, malware, and legitimate tool abuse. This demonstrates how commercial AI accelerates existing intrusion workflows rather than introducing fundamentally new attack capabilities.
Threat actors impersonate university leaders in phishing emails falsely alleging sexual misconduct to trick victims into installing RATs. The social engineering lure exploits sensitive claims to enable malware delivery, providing attackers full system access and control.
Multiple cryptocurrency firms (Trezor, CoinTracking, BitBox) are warning customers of phishing emails following a breach at their shared email provider. Attackers compromised the provider's infrastructure, injecting malicious content into legitimate newsletters.
Attackers exploit Microsoft services and blob URLs to generate phishing pages directly in victims' browsers, evading detection of static websites. This stealthy technique makes blocking and analysis harder for email security defenders.
Attackers are leveraging multi-hop Google redirects to bypass security filters in phishing campaigns designed to steal credentials or deploy ScreenConnect malware. This technique exploits Google's trusted reputation to evade detection systems.
BigBear phishing crew harvested thousands of Microsoft 365 credentials and session cookies across hundreds of organizations. The operation, using Evilginx2-based phishing-as-a-service, captured hundreds of authenticated sessions capable of bypassing MFA. Researchers gained access to the attackers' admin panel, revealing unprecedented campaign details.
Researchers discovered a phishing service streaming real Google login pages to attackers in real-time, enabling interception of passwords, 2FA codes, and authenticated sessions. This sophisticated credential-theft technique poses significant risk to organizations relying on Google Workspace for email and collaboration.
Cybercriminals compromised Brazilian government servers to host phishing sites, leveraging a reverse-proxy network with gambling themes. A Chinese-language group is behind the campaign, targeting government and education infrastructure for malicious hosting.
CloudSEK discovered BigBear 2.0, a phishing-as-a-service campaign that has stolen over 5000 Microsoft credentials by targeting Microsoft 365 users. This threat directly affects email security as it leverages phishing to compromise email accounts and organizational infrastructure.
The week's most important email-security news, curated and summarized — every Monday morning. No tracking, one-click unsubscribe.