MailSecHub aggregates coverage of phishing campaigns, business email compromise, malware delivery, spoofing and email authentication (SPF, DKIM, DMARC) from top reputable sources. The pipeline polls every two hours, deduplicates and classifies each story by threat category — filter by source or topic to get to what is relevant to your environment.
A weekly briefing summarizes the most significant developments, and the same digest is delivered every Monday morning via the newsletter.
Microsoft is integrating AI-powered phishing detection into Teams to identify scams in conversations, particularly in initial external contact exchanges where attackers impersonate support staff. The feature analyzes conversation context rather than relying solely on links or attachments, addressing a common social engineering threat vector.
Russian-linked hackers Sandworm and UAC-0099 used a spear-phishing email with malicious attachment to breach a Ukrainian logistics company, deploying a new mesh network backdoor for destructive wiping attacks.
EU regulators are investigating Booking.com's protection measures against phishing attacks targeting its customers. The Commission will assess whether the platform has implemented adequate safeguards. This highlights platform responsibility for email-based fraud threats.
Researchers discovered Athena StealthRoute, a phishing-as-a-service platform with AI capabilities that generates phishing lures and decoy content to hide malicious activity. This poses a significant threat as it lowers the barrier for attackers to launch sophisticated phishing campaigns against email users.
Generative AI is making malicious emails harder to detect by eliminating behavioral tells like poor grammar and generic templates. Attackers now use AI to craft fluent, personalized messages that evade behavior-based email security filters. This erodes a key detection mechanism email security professionals have relied upon.
The EU is investigating Booking.com under the Digital Services Act for inadequate efforts to prevent fraud, phishing, and smishing on its platform. The probe covers whether the travel site fails to stop fraudulent listings and protect users from scams.
Threat actors are hijacking email threads by appending malware and phishing content to legitimate conversations, exploiting recipient trust in known senders. This tactic targets users by hiding malicious payloads within ongoing email exchanges.
Scammers exploit Frame.io notifications to conduct phishing attacks targeting Microsoft 365 credentials. The campaign uses legitimate notification services with hidden PDF links to deceive users into disclosing credentials.
Japanese police arrested a Chinese couple who hid a computer behind a hotel fridge in Kobe to send nearly 480,000 phishing emails and commit credit card fraud. The operation demonstrates how phishing infrastructure can be concealed and remotely deployed to evade detection.
Attackers are hosting fake Google Meet pages to phish for Google credentials and 2FA codes. The campaign exploits user familiarity with the legitimate service to increase success rates. This is a direct threat to enterprise users relying on Google Workspace for email and collaboration.
Threat actors are using device code phishing attacks to circumvent password-based authentication by mimicking legitimate corporate emails. This technique allows attackers to blend malicious requests into normal inbox traffic while targeting authentication mechanisms beyond traditional passwords. Email security professionals need awareness of this evolving phishing tactic.
Hackers registered teams-cloud[.]live, a fake Microsoft Teams login domain, to steal credentials from workplace users. The phishing site copies Teams' interface to deceive employees into entering credentials, discovered just five days after registration. Organizations should block the domain to prevent employee compromise.
Google announced new Android AI protections against scam calls, phishing links, and OTP theft via spoofed numbers and fake alerts. These defenses target mobile fraud across calls, SMS, chat, and web links. Relevant to email security professionals monitoring phishing and credential theft tactics.
APT group UAT-11985 uses fake event invites to target Taiwan research affiliates with Google AitM phishing attacks, harvesting credentials and MFA codes. The campaign leverages sophisticated email-based social engineering to compromise accounts at research organizations through credential theft.
Attackers exploited over 20,000 Cloudflare Pages domains to distribute fake Microsoft security alerts directing users to tech support scams via Help TDS routing. The campaign uses fake browser locks and alarms to pressure victims into calling scam centers. This represents a significant phishing infrastructure abuse affecting email-based spam distribution vectors.