Tag: email security
48 articles
Cisco Email Flaw Exploited in Zero-Day Attacks
Cisco is urging customers to upgrade to a fixed software release after a critical vulnerability in its Secure Email Gateway was exploited in active zero-day attacks, allowing hackers to gain root access with just a malicious email. The flaw, scored 9.8 out of 10 on the CVSS scale, enables remote attackers to write files and execute commands with root privileges on the appliance operating system.
Microsoft Outlook to Block MSIX Attachments in Security Push
Microsoft is bolstering security in Outlook on the web and Windows by blocking MSIX attachments, including .msix and .msixbundle file types, to protect users from potential threats. This update will be applied to the default list of blocked file types, enhancing overall security in the platform.
Phishing Emails Embed AI Prompt Injections to Target Human and Machine
Phishing emails are now cleverly embedding AI prompt injections to deceive both human recipients and machine learning-based email summarizers, allowing scammers to target two victims at once. These sneaky attacks use techniques like hidden text and encoded data to conceal their malicious intent.
Linux Backdoors Masquerade as Email Security Tools in Korea, Taiwan Attacks
Cyber attackers are sneaking Linux backdoors into systems in Korea and Taiwan, cleverly disguising them as email security tools to fly under the radar. The malware, known as AVERAT, uses a sneaky tactic of communicating with its controllers via ordinary email protocols to avoid detection.
Microsoft expands Outlook restrictions to block two more file types
Microsoft is taking a firmer stance on email attachments, adding two new file types to Outlook's restricted list in a bid to boost security and keep users safe. This move is the latest effort to crack down on potentially hazardous files.
Microsoft Exchange Flaw Exposes Mailboxes to Authenticated Attackers
A newly discovered flaw in Microsoft Exchange Server could put your mailboxes at risk, allowing authenticated attackers to elevate their privileges and gain unauthorized access across your network. Microsoft has urgently released a security update to patch this high-severity vulnerability, rated 8.8 on the CVSS scale.
Hackers Exploit M365 Feature in Targeted Phishing Campaign
KnowBe4's Threat Lab team uncovered a massive phishing campaign, detecting 29,785 confirmed phishing emails that exploited Microsoft 365's Direct Send feature over just two months. The attacks followed a surprisingly human pattern, spiking on Mondays and Tuesdays during US business hours.
Trezor Phishing Attacks Target 347,000 Users After Brevo Breach
Phishing attacks have hit 347,000 Trezor users after a security breach at Brevo, the marketing platform used by Trezor for its newsletter campaigns, exposed sensitive email addresses. Trezor quickly sprang into action, suspending its Brevo account and taking down the malicious domain within 20 minutes to limit the damage.
cPanel Flaw Enables Code Execution as Root via Mail Privileges
A critical cPanel security flaw, known as CVE-2026-67401, allows hackers with mail-related privileges to create files on a server and execute code as the root user, putting your entire system at risk. This vulnerability affects every supported version of cPanel and WHM, making it crucial to take immediate action.
Microsoft Warns of Phishing Campaign Using Invisible Unicode to Evade Filters
Microsoft uncovered a massive phishing campaign that sent a whopping 1-2.37 million messages daily on weekdays, peaking on February 26, 2026, and cleverly used invisible Unicode characters to slip past filters. The campaign's weekly rhythm was remarkably consistent, with a sharp drop in activity after May 15, 2026.
SVG Attachments Fuel Large-Scale Phishing with JavaScript Smuggling
A massive phishing campaign, detected in over 5,500 organizations, used sneaky JavaScript smuggling tactics to evade native defenses, with a whopping 26,589 messages sent over just two months. The attackers cleverly exploited SVG attachments and voicemail lures to spread executable code.
AI-Powered Phishing Attacks Force Defenders to Deploy Counter-Agents
Get ready for Phishing 3.0, where AI-powered attacks are revolutionizing the game, forcing defenders to level up their security strategies with cutting-edge counter-agents. AI-driven phishing is no longer just about malicious links and emails - it's a sophisticated, multi-channel threat that's researching, adapting, and striking with precision.
CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens
Researchers have discovered alarming proof-of-concept techniques that allow attackers to exploit styled HTML in emails, breaking through webmail defenses to steal passwords, tokens, and even hijack trusted actions. This vulnerability affects major email services including Outlook, Gmail, and Yahoo Mail, and public proof-of-concept code is readily available.
AI Spam Filters Vulnerable to Text Salting Attacks
Over 1 million retail-themed phishing emails have been detected using a sneaky technique called text salting to evade AI spam filters since April. This clever trick hides harmless words in malicious messages, fooling automated scanners but not the human eye.
Zimbra Warns of Stored XSS Flaw in Classic Web Client
Zimbra is urging customers to update their Classic Web Client immediately due to a critical vulnerability that could allow hackers to access sensitive mailbox information and execute malicious code via specially crafted emails. Installing the update, specifically upgrading to Zimbra Collaboration Suite version 10.1.19, will help protect against this threat.
EvilTokens Exposes New Blind Spot in Email Security
A shocking 75.6% of consulting firms were exposed to phishing attacks in 2026, with other industries like financial services, manufacturing, and tech also falling prey to these threats. EvilTokens' ghost phishing campaign uses a sneaky Microsoft Device Code Phishing tactic to trick victims into giving hackers access to their Microsoft 365 accounts.
Meta Disrupts Phishing Campaign Targeting Facebook Business Users
Watch out for phishing scams targeting Facebook Business users - red flags include broken graphics, suspicious links, and unsolicited emails promising exciting opportunities. Experts warn that cybercriminals are getting sneaky, using legitimate-looking emails and Messenger chatbots to trick victims into taking action.
Microsoft Uncovers Large-Scale Phishing Campaign Using Fake Compliance Emails
In just 48 hours, a massive phishing campaign targeted over 35,000 users across 13,000 organizations in 26 countries, using convincing fake compliance emails to steal login credentials. The sophisticated attack, detected by Microsoft's Defender Research team, hit US firms hard, but its global reach was widespread.
Phishing Attacks Exploit Amazon SES to Evade Detection
Kaspersky researchers have uncovered a surge in phishing attacks that cleverly exploit Amazon's trusted email service to evade detection. By using valid Amazon SES credentials, attackers can send convincing phishing messages that slip past standard security checks.
Attackers Exploit Amazon SES to Bypass Email Security in Phishing Campaigns
Phishing campaigns are now using Amazon's Simple Email Service to make malicious messages look legit, bypassing standard email security checks and putting victims at risk of revealing sensitive data. By exploiting Amazon SES's trusted reputation and authentication features, attackers are making it harder to spot phishing emails.
Microsoft to Discontinue Legacy TLS Versions in Exchange Online by July 2026
Microsoft is putting the brakes on outdated security protocols, announcing that it'll start blocking legacy TLS 1.0 and 1.1 connections to Exchange Online in July 2026 - so it's time to upgrade and stay secure! This move marks the end of an era for older clients that still rely on these outdated protocols.
Microsoft Phases Out Legacy TLS in Exchange Online
Microsoft is phasing out support for outdated TLS versions (TLS 1.0 and TLS 1.1) for POP3 and IMAP4 connections to Exchange Online, starting July 2026, to boost security. From then on, only TLS 1.2 or later will be accepted, making older connections obsolete.
Healthcare Breaches Decline, But Lax Email Security Persists
Alarmingly, nearly three-quarters of breached healthcare organizations had weak email defenses, with 74% either lacking a DMARC policy or having it set to monitor-only mode, leaving them vulnerable to attacks.
Phishing Attacks Exploit Email Blind Spots with Silent Subject Lines
Phishing attacks are on the rise, with a 13.9% surge in January and February, followed by a 7% increase in March, and cybercriminals are getting sneaky by using empty subject lines to bypass email defenses and pique human curiosity. By ditching the subject line, attackers are exploiting a blind spot that can trick both automated filters and human instincts.