Daily news, analysis, and guidance on DMARC and email security.
Daily news, analysis, and guidance on DMARC, SPF, DKIM, and the broader world of email security — from the team at Excello Mail.
On September 9, 2026, roughly 347,000 people who had signed up for Trezor’s newsletter received an email warning them that a factory defect in the STM32 microcontroller used in their hardware …
Every campaign in this series so far has started with a message landing in an inbox. PREY-0058 does not. Arctic Wolf is tracking a widespread cluster of intrusions that begins with a phone call or a …
Most phishing kits still fail the moment a target has multi-factor authentication turned on. BigBear 2.0 does not. Researchers on CloudSEK’s TRIAD team found the operator’s control panel …
Most of the campaigns we cover pass DMARC by routing around it entirely, borrowing a compromised mailbox, an OAuth token, or a reputable ESP’s sending pool. Email security vendor IRONSCALES …
Between June 1 and August 4, email security vendor INKY, now part of Kaseya, tracked a phishing campaign that ran in waves, mostly stopping on weekends, and landed 26,589 messages in 5,527 …
Research from ANY.RUN, published August 25, started with something narrow: a wave of fake Canada Revenue Agency T4 tax slips landing in Canadian inboxes. By the time the researchers finished tracing …
In June, Google sued the operators behind Outsider, a phishing-as-a-service kit tied to a threat actor known as ChenLun, and the FBI’s Cyber Division opened Operation Ghost Hook the very next …
ASCII smuggling started out as a problem for AI systems: hide invisible Unicode characters inside a block of text, and a large language model reading that text can be steered by instructions no human …
Most phishing analysis assumes a link either leads to something bad or it does not, and that whoever tests it will see the same thing an intended victim sees. Research the SANS Internet Storm Center …
Most of the posts in this series look at what a phishing email does while it is still an email: what domain it claims to be from, what link it carries, what attachment it hides behind. Research …
Most email security products still describe themselves by what they scan: links, attachments, headers. On August 31, KnowBe4 announced Defend for Google Workspace, its first extension of behavioral …
Most phishing emails still rely on a link. A recipient clicks it, lands on a hosted page somewhere, and that page’s domain is at least something a security team can flag or block. New research …
