Every post we’ve published — newest first.
Most of the email injection bugs covered here start in a narrow corner of the internet: one WordPress plugin, one Java library. CVE-2026-50659 does not. It sits inside System.Net.Mail, the SMTP client built into every …
A fake job offer is one of the oldest lures in phishing. What CTM360 documented this month in a campaign it calls RecruitTrap is not old at all: a fake browser window convincing enough to fool the browser itself, wired …
Azure Monitor is a legitimate Microsoft service that watches your cloud resources and emails you when something needs attention. That is exactly why threat actors have spent the past several months turning it into a …
Most secure email gateways rewrite the links inside a message before it ever reaches an inbox, replacing the original URL with a vendor-branded one that routes through the vendor’s scanning infrastructure first. It …
Publishing a DMARC record with p=reject is supposed to be the finish line. It tells every receiving mail server, in writing, to throw away anything claiming to be from your domain that cannot prove it. Security …
Barracuda published research on July 29, 2026, tracking the evolution of LogoKit, a phishing kit that has circulated in criminal markets since 2018. What used to be a simple template that swapped in a static company logo …
Barracuda’s Red Team published research on August 4, 2026, ahead of Black Hat USA 2026, that should reframe how security teams think about the AI assistants now built into every major mailbox. Their controlled …
Check Point’s Harmony Email research team disclosed a phishing campaign built on a premise that should worry anyone who treats authentication as proof of safety: the messages were not spoofed at all. They were sent …
Gen Digital, the company behind Norton and Avast, published its H1 2026 Threat Report this month, and buried inside it is an attack chain that deserves more attention than a single line item. Researchers documented a …
At Black Hat USA 2026, PortSwigger researcher Gareth Heyes presented a talk called “CSS: the bomb inside your inbox,” and the finding underneath the title is a genuinely uncomfortable one for anyone who …
LevelBlue’s SpiderLabs threat research team, the group formerly under AT&T Cybersecurity, closed out its review of 2025 business email compromise activity with a number that should reframe how most security …
Arctic Wolf researchers are tracking a widespread, email-driven phishing campaign that shares clear tactical overlap with Storm-2755, the cluster Microsoft first named “Payroll Pirate” in April after it …
