Rebecca WarrenWhat's happening in email security: August 10 - August 16, 2026
Reputation was the currency this week, and attackers kept spending other people's. A China-based group slipped one line of script into a government's shared webmail and let the real login page do the work. Lazarus ran its command channel through other people's Roundcube servers and phished from a company it had already breached. Researchers found three ways to bend passkeys without breaking them, and one buyer has spent nearly $7 million on expired domains for the reputation they still carry.
One script tag turned more than 15 government webmail tenants into a trap
Symantec published research on Jewelbug, a China-based group also tracked as Earth Alux and REF7707, and its webmail campaign didn't start with a phishing email. The group compromised a shared web-hosting platform run by a state telecommunications provider and a national network-services agency, which gave it write access to a webmail installation used by multiple government ministries and agencies. It added a single script tag to a common template, and that script ran on login pages and mailbox views across more than 15 government webmail tenants.
On login, the script opened a WebSocket to the attackers, sent off the user's webmail cookies and read their email address. If the address sat on a targeted government domain, the user got a fake Adobe Flash update that installed Antino, a Windows backdoor that uses the Microsoft Graph API for command and control so its traffic blends in. Symantec's look inside the group's database counted more than 580,000 stolen browser cookies, several thousand captured credentials and more than 2,300 exfiltrated email bodies.
Every cue users are taught to check was genuine. Right address, real login page, their own mailbox. The compromise sat a layer below, at the hosting provider. If your webmail runs on shared or outsourced hosting, find out who can write to the templates and whether anyone would notice a new script tag. Integrity monitoring on those files and a tight Content Security Policy don't cost much. And since cookies were the prize, a password reset won't close the door. Kill the sessions too.
Three new attacks show where passkeys can still be bent
Three separate research efforts landed together, and none of them breaks the cryptography. SpecterOps' Michael Grafnetter showed at Black Hat USA that Windows stored past YubiKey signatures in cleartext where an authenticated, unprivileged user could read them (CVE-2026-34348, CVSS 6.5). Chained with weaknesses in how Entra ID validates passkeys, that allowed impersonating privileged users even where policy required phishing-resistant MFA. Unit 42's Pass-ta-key research went after Google Password Manager's synced passkeys in Chrome on Windows, including the 32-byte secret that protects them, which Unit 42 says Google currently offers no way to rotate or revoke.
Independent researcher Dirk-jan Mollema showed that malware in a signed-in Windows session can use a Windows Hello for Business key without a fresh PIN or biometric prompt and present it to Entra ID as a FIDO2 credential. The Entra challenge stays valid for five minutes and isn't bound to a session, user or tenant, so the attacker can request it on one machine and get it signed on the victim's. That sign-in can satisfy Conditional Access rules demanding phishing-resistant authentication.
None of this makes passkeys a bad bet. Each attack needs a foothold first, which is a far harder start than a phishing kit. What changes is how much a phishing-resistant sign-in proves. A strong method presented from a compromised device is still a compromised sign-in. Install the fix for CVE-2026-34348, alert on Windows Hello for Business sign-ins that arrive without a device identifier, and watch for unexpected device registrations. Entra starts auto-enabling passkeys for SMS and voice users on September 1, so this is about to be your default.
Lazarus ran its command channel through other people's Roundcube servers
Check Point's latest look at Lazarus's Operation Dream Job, aimed at defense and aerospace firms in France, Germany, Brazil and India, made headlines for a Windows zero-day (CVE-2026-68820, fixed this Patch Tuesday). The bit email teams should care about is the infrastructure. Instead of standing up its own servers, the campaign hijacks "legitimate but compromised WordPress and SharePoint websites and vulnerable Roundcube webmail servers." On Roundcube boxes exposed to CVE-2025-49113, the operators planted RelayShell, a previously undocumented PHP web shell, and used those servers as command and control for the ForestTiger backdoor.
Delivery borrowed reputation too. In at least one case an already breached France-based organization was used to send phishing to new victims, to get past reputation-based filters. The lures used the Lockheed Martin and Enveil names, and sites like enveil[.]online were set up to distribute a trojanized PDF viewer.
If your Roundcube isn't patched past CVE-2025-49113, it could be someone else's relay right now. Look for unfamiliar PHP files in the web root and outbound traffic your webmail has no reason to make. Mail from a compromised partner carries years of good history and authenticates cleanly, so behavior is what catches it, like a first-ever request to install software.
Valve told Steam hardware buyers to treat delivery confirmation and fee requests as fake
Valve's shipping partner CEVA Logistics was hit by a cyberattack between July 29 and August 1 that likely exposed names, addresses, phone numbers, email addresses and order details for European Steam hardware buyers. Its customers can now expect messages that know exactly what they bought and where it went. Valve's guidance was blunt. Scammers "may ask you to confirm a delivery, pay a small customs or redelivery fee," and customers should "Treat all of them as fake."
Three days later, Trezor said its logistics provider ShipMonk had been hacked, exposing full contact details for 11,742 customers and partial details for 1,947 more, who "might be targeted by more sophisticated phishing attempts." Neither brand was breached, yet both now own an impersonation problem. If you ship physical goods, your logistics partner holds exactly the data that makes a fake delivery notice convincing. Ask what they keep (CEVA holds delivery data for up to 90 days), and publish how you will and won't contact customers before you need to.
One buyer spent nearly $7 million on expired domains because reputation comes with the name
Infoblox measured the market for "dropcatch" domains, expired names re-registered by someone new. In the first half of 2026 about 50,400 were re-registered daily across gTLDs, around 65,000 with country-code domains included, nearly one in five daily registrations. One buyer it tracks, Sable Squirrel, has spent nearly $7 million on expired domains and holds more than 10,000 domains, mostly serving a Vietnam-linked sports piracy operation. Once re-registered, the domains move fast. 24% go live the same day and 94% within two weeks.
Why pay auction prices when you could register a new name? Infoblox puts it plainly. "These domains can be particularly interesting, even dangerous, because they inherit reputation." A dropped domain arrives with its age, its leftover traffic, the links still pointing at it and the email still addressed to its old owner. That last one is your problem. A domain from a finished campaign or a retired product can keep collecting replies, invoices and password resets long after you stop paying for it. Before anything lapses, check what still sends to it and what still references it in DNS, SPF or vendor configs. Another year of renewal is usually cheaper.
- Microsoft's August Exchange update switches off OWA Light for good
The August security updates for Exchange Server SE, 2019 and 2016 (the last two only for Period 2 ESU customers) permanently disable OWA Light, tied to spoofing flaw CVE-2026-62914, and Microsoft says anyone who can't install the update should turn OWA Light off on their servers.
- RingCentral's breach exposed contact details for 1.6 million accounts
Have I Been Pwned confirmed names, email addresses, phone numbers and physical addresses from the July breach RingCentral blamed on a "sophisticated social engineering campaign," fresh targeting data for a brand phishing kits already spoof.
- Kimsuky is building an offline AI stack
Genians found Ollama, GPT4All and Msty set up on servers tied to the North Korean group, though nothing yet shows the stack used against a victim. The advice holds anyway. Stop grading spear-phishing by its grammar and watch the LNK-to-PowerShell activity that follows the click.
- Ukraine shut down 94 call centers that impersonated bank staff and police
Police, the SBU and prosecutors, with German help, ran 411 searches and seized 1,794 workstations, 5,200 SIM cards and $2 million in cash from operations whose callers posed as bank officers, brokers and law enforcement.
- A White House memo would let vetted private firms hack foreign phishing crews
A national security presidential memorandum signed by President Trump tells the National Coordination Center to set up a program in which vetted security companies can run limited cyber operations, at the direction of the US Government, against foreign groups behind ransomware, phishing, financial fraud, sextortion and impersonation scams. The White House pointed to more than $20.8 billion in US consumer losses to cyber-enabled crime in 2025.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.