Every post we’ve published — newest first.
Today is the day California’s Delete Act stops being a compliance deadline on a calendar and starts being an enforcement reality. As of August 1, 2026, every one of the more than 600 data brokers registered with …
Japanese telecom operator KDDI confirmed that attackers had exploited a zero-day vulnerability in third-party software to break into a shared email platform it runs for internet service providers. The intrusion happened …
Infobip announced on July 9, 2026 that it had acquired SocketLabs, a Pennsylvania-based email infrastructure company that processes more than 1.2 billion messages a month for over 2,000 businesses. On its face this is a …
Huntress published research on July 7, 2026 detailing a phishing campaign that ran undisturbed for roughly eight months by exploiting something no authentication protocol was ever built to catch: a real feature, working …
Researchers tracking a campaign now called Operation BlueDash have documented a phishing operation that skips the part most email defenses are built to catch. There is no lookalike domain to flag, no spoofed sender to …
Tim Draegen is one of the original authors of the DMARC specification and the founder of dmarcian, Inc., a company built to help other organizations monitor and enforce the very standard he helped write. On July 10, …
CISA, the NSA, the FBI, and cybersecurity agencies from more than a dozen allied nations, including the Netherlands, the UK, Australia, and Canada, issued a joint advisory this week exposing an active campaign by LAUNDRY …
In May we covered the wave of class action lawsuits filed under Washington’s Commercial Electronic Mail Act, or CEMA, after the state Supreme Court’s decision in Brown v. Old Navy held that the law’s …
PowerDMARC’s United States DMARC & MTA-STS Adoption Report 2026, drawn from more than 900 domains across major industries, put national DMARC adoption at 95.8% and national DMARC enforcement, a policy of …
Germany’s Federal Criminal Police Office and the Frankfurt public prosecutor’s cybercrime unit, working alongside the FBI’s Dallas Field Office and the US Attorney’s Office for the Northern …
DKIM is the part of email authentication that proves a message was not altered in transit and really was signed by the domain it claims to come from. That guarantee is only as strong as the key doing the signing and the …
Check Point Research recently disclosed a phishing campaign that did not need a single fake domain, a spoofed sender, or a cloned login page to work. Researchers found more than 3,200 copies of the same message: a summer …
