Every post we’ve published — newest first.
For years, Smart Network Data Services has been the closest thing senders had to a direct line into how Microsoft’s consumer mailboxes, Outlook.com and Hotmail, actually judge their traffic. It is free, it is first …
Researchers at Expel spent this month picking apart a malware family they had never seen before. It calls itself, or at least its file names suggest, SynkLoader, and it reaches victims through a channel that a lot of …
A Dark Reading readership poll released this month found that 48% of security professionals now rank agentic AI as the top attack vector heading into the rest of 2026, ahead of deepfakes, board-level cyber awareness, and …
Most of the phishing campaigns we cover here start with an email. This one does not, and that is exactly why it belongs in this newsletter. Threat intelligence firm ReliaQuest published a Threat Spotlight this month …
Google’s Threat Intelligence Group published a report this week tracking three suspected Russian-nexus hacking clusters running espionage campaigns against academics, diplomats, defense industry professionals, and …
We covered RFC 9989, the DMARCbis update, when it landed earlier this year. One of its headline fixes was the np= tag, a policy specifically for subdomains that do not exist. A DNSSEC researcher’s writeup making …
Most of the email injection bugs covered here start in a narrow corner of the internet: one WordPress plugin, one Java library. CVE-2026-50659 does not. It sits inside System.Net.Mail, the SMTP client built into every …
A fake job offer is one of the oldest lures in phishing. What CTM360 documented this month in a campaign it calls RecruitTrap is not old at all: a fake browser window convincing enough to fool the browser itself, wired …
Azure Monitor is a legitimate Microsoft service that watches your cloud resources and emails you when something needs attention. That is exactly why threat actors have spent the past several months turning it into a …
Most secure email gateways rewrite the links inside a message before it ever reaches an inbox, replacing the original URL with a vendor-branded one that routes through the vendor’s scanning infrastructure first. It …
Publishing a DMARC record with p=reject is supposed to be the finish line. It tells every receiving mail server, in writing, to throw away anything claiming to be from your domain that cannot prove it. Security …
Barracuda published research on July 29, 2026, tracking the evolution of LogoKit, a phishing kit that has circulated in criminal markets since 2018. What used to be a simple template that swapped in a static company logo …
