Every post we’ve published — newest first.
On October 1, 2026, Fortinet published a security advisory for a vulnerability in FortiMail, its email security gateway, and acknowledged that the flaw is being exploited in the wild. The US Cybersecurity and …
A domain can have a DMARC record that looks perfectly valid in every way, sit at p=reject, cite a real reporting address, and still protect nothing. It happens the moment a second TXT record shows up at the same _dmarc …
Microsoft built RejectDirectSend to close a specific hole: unauthenticated mail claiming to come from inside an organization’s own domain. Researchers at ReliaQuest found that the control can be walked around …
Between August 3 and 5, 2026, Microsoft Threat Intelligence tracked more than a million emails hitting enterprise inboxes across the United States, each one built around the same pitch: a ServiceNow annual subscription …
On August 18, 2026, Huntress researchers investigating an adversary-in-the-middle attack stumbled onto the operator console behind it: a phishing kit its author calls Knight Office. Inside Huntress’s own customer …
Between April and July 2026, KnowBe4 ThreatLabs added 1,660 domains ending in .vu, Vanuatu’s country-code extension, to its global phishing blocklist. That is a 159.6% jump over the prior period, tied to 28,167 …
On September 9, 2026, roughly 347,000 people who had signed up for Trezor’s newsletter received an email warning them that a factory defect in the STM32 microcontroller used in their hardware wallet made their …
Every campaign in this series so far has started with a message landing in an inbox. PREY-0058 does not. Arctic Wolf is tracking a widespread cluster of intrusions that begins with a phone call or a text message, and by …
Most phishing kits still fail the moment a target has multi-factor authentication turned on. BigBear 2.0 does not. Researchers on CloudSEK’s TRIAD team found the operator’s control panel and got into it …
Most of the campaigns we cover pass DMARC by routing around it entirely, borrowing a compromised mailbox, an OAuth token, or a reputable ESP’s sending pool. Email security vendor IRONSCALES documented something …
Between June 1 and August 4, email security vendor INKY, now part of Kaseya, tracked a phishing campaign that ran in waves, mostly stopping on weekends, and landed 26,589 messages in 5,527 organizations. The largest …
Research from ANY.RUN, published August 25, started with something narrow: a wave of fake Canada Revenue Agency T4 tax slips landing in Canadian inboxes. By the time the researchers finished tracing the infrastructure …
