Every post we’ve published — newest first.
CISA, the NSA, the FBI, and cybersecurity agencies from more than a dozen allied nations, including the Netherlands, the UK, Australia, and Canada, issued a joint advisory this week exposing an active campaign by LAUNDRY …
In May we covered the wave of class action lawsuits filed under Washington’s Commercial Electronic Mail Act, or CEMA, after the state Supreme Court’s decision in Brown v. Old Navy held that the law’s …
PowerDMARC’s United States DMARC & MTA-STS Adoption Report 2026, drawn from more than 900 domains across major industries, put national DMARC adoption at 95.8% and national DMARC enforcement, a policy of …
Germany’s Federal Criminal Police Office and the Frankfurt public prosecutor’s cybercrime unit, working alongside the FBI’s Dallas Field Office and the US Attorney’s Office for the Northern …
DKIM is the part of email authentication that proves a message was not altered in transit and really was signed by the domain it claims to come from. That guarantee is only as strong as the key doing the signing and the …
Check Point Research recently disclosed a phishing campaign that did not need a single fake domain, a spoofed sender, or a cloned login page to work. Researchers found more than 3,200 copies of the same message: a summer …
Bluekit is not a new name. Varonis Threat Labs first documented the phishing-as-a-service kit in April 2026, cataloguing an AI assistant built on jailbroken language models, more than 40 templates spoofing brands from …
On July 13, 2026, LastPass’s Threat Intelligence, Mitigation, and Escalation team flagged an active phishing campaign built around two freshly registered domains, lastpassnewsletter.com and lastpasscompliance.com. …
Will Thomas, a senior advisor at the threat intelligence firm Team Cymru, has spent the past several weeks pulling apart a phishing operation that has been running for at least five months without much attention. The …
The postmaster team at 1&1 Mail & Media, the company behind GMX, WEB.DE and mail.com, told the mailop mailing list this quarter that it is rolling out full inbound DMARC enforcement across its infrastructure, …
Researchers at ANY.RUN have spent the past several weeks documenting a phishing kit called EvilTokens, active since at least February 2026 and sold through Telegram channels, that hides its Microsoft 365 credential-theft …
Researchers at XBOW disclosed a critical vulnerability in Exim, nicknamed Dead.Letter and tracked as CVE-2026-45185, that lets an unauthenticated attacker execute arbitrary code on a mail server by sending a single stray …
