Every post we’ve published — newest first.
Bluekit is not a new name. Varonis Threat Labs first documented the phishing-as-a-service kit in April 2026, cataloguing an AI assistant built on jailbroken language models, more than 40 templates spoofing brands from …
On July 13, 2026, LastPass’s Threat Intelligence, Mitigation, and Escalation team flagged an active phishing campaign built around two freshly registered domains, lastpassnewsletter.com and lastpasscompliance.com. …
Will Thomas, a senior advisor at the threat intelligence firm Team Cymru, has spent the past several weeks pulling apart a phishing operation that has been running for at least five months without much attention. The …
The postmaster team at 1&1 Mail & Media, the company behind GMX, WEB.DE and mail.com, told the mailop mailing list this quarter that it is rolling out full inbound DMARC enforcement across its infrastructure, …
Researchers at ANY.RUN have spent the past several weeks documenting a phishing kit called EvilTokens, active since at least February 2026 and sold through Telegram channels, that hides its Microsoft 365 credential-theft …
Researchers at XBOW disclosed a critical vulnerability in Exim, nicknamed Dead.Letter and tracked as CVE-2026-45185, that lets an unauthenticated attacker execute arbitrary code on a mail server by sending a single stray …
Okta Threat Intelligence published research on July 6, 2026 into a threat actor it tracks as O-UNC-066, and the campaign is notable for what it leaves out rather than what it includes. There is no phishing email, no …
Proofpoint has spent since May 2026 tracking a threat cluster it calls UNK_MassTraction, and the campaign is a useful reminder that some of the most damaging email-borne attacks never touch anything DMARC was built to …
CERT Polska has spent the past several months tracking an intensified phishing campaign from UNC1151, the Belarus-linked threat group also known as Ghostwriter. Since March 2026, the group has shifted its long-running …
Two phishing-as-a-service platforms surfaced in the first week of July 2026, and neither one builds a fake login page. DEBULL, documented by researchers at ZeroBEC, and ARToken, an affiliate panel of the EvilTokens …
A newly disclosed vulnerability in Kirki, a WordPress customizer framework installed on more than 500,000 sites, lets an unauthenticated attacker send phishing email through a site’s own outbound mail server. No …
Researchers at Palo Alto Networks’ Unit 42 have documented an attack pattern that skips the inbox entirely. Large language models, it turns out, are remarkably consistent about inventing web addresses that sound …
