Rebecca WarrenWhat's happening in email security: August 31 - September 6, 2026
What counts as proof took a beating this week. A loan-spam operation slipped invisible characters into its keywords and sent the mail through a reputable marketing platform. A new Microsoft 365 kit sent DocuSign lures that appeared to come from the recipient's own address, then planted a passwordless key that outlived the stolen session. Nearly 22,000 Exchange servers were still exposed to a bug that can hand over every mailbox, and a dark web shop claimed to be selling more than 153 million driver's license scans, which is bad news for any process that treats a photo of an ID as proof.
Phishers split their keywords with Unicode characters nobody can see
Microsoft's research into prompt injection protection for Defender for Office 365 turned up a high-volume loan phishing campaign that borrowed its trick from that very field. The technique, ASCII smuggling, uses the Unicode Tags block, U+E0000 to U+E007F, a mostly deprecated range of characters that don't render. The attackers mostly dropped U+E0020, the tag space, into their lure words, so "funding" became "fun", an invisible character, then "ding". A person reads funding. A filter matching the literal string sees a word it doesn't know.
Signature hits jumped from about 21,000 messages on February 8 to more than 1.3 million on February 9. Weekday volumes ran from 1 million to 2.37 million in the first intense phase, stepped down by about 80% by late March and fell off sharply after May 15. Most of the mail came from a cluster of roughly 150 finance-themed sender domains, and that finance-themed pattern made up about 96% of what the signature caught. It was relayed through ActiveCampaign, a legitimate email marketing platform. Microsoft notes that abuse of customer accounts on a reputable shared platform "can complicate reputation-based filtering."
The good news is that more than 99% of these messages were still flagged by layers that didn't depend on spotting the hidden characters, like sender, URL and domain reputation and machine learning. What this beats is the literal keyword rule, the kind plenty of teams write themselves in transport rules. Microsoft's fix is to normalize before you match. Strip or fold invisible code points before any keyword check, regex or signature runs, and treat tag characters in a subject or body as a strong anomaly, minus the England, Scotland and Wales flag emoji, which use them legitimately. Do the same before mail reaches an AI assistant, since that's where this trick started.
Knight Office mails DocuSign lures from your own address, then plants a passwordless key
Huntress found the operator console for a Microsoft 365 phishing kit called Knight Office while investigating an adversary-in-the-middle attack on August 18. The lure is a DocuSign-style signature reminder with forged From, To and Return-Path headers, so it appears to come from the recipient's own address, and Huntress' awareness-training telemetry shows at least 700 reported emails using variations of it since April. Links bounce through a Monday.com redirect and a compromised Joomla site to a fake SharePoint document or Teams voicemail page.
That page hands the victim a code and sends them to Microsoft's real device login, where they enter it, type their password and approve the MFA push while the relay captures the session tokens. Huntress tied at least nine token replay logins in two weeks, and at least 25 .vu phishing domains, to the kit. Then the attacker registered a rogue device in Entra ID, bound a Windows Hello for Business key to the account and signed in passwordlessly, which gets them back in after the stolen tokens are revoked.
A message from a user to themselves that they never sent points straight back at your own domain, so if self-spoofed mail is landing, confirm your DMARC policy is at enforcement and that no inbound connector or allow rule skips the check. And when you close a token theft case, review newly registered Entra devices and Windows Hello for Business keys and remove any authentication method you didn't issue, as Huntress recommends. Revoking sessions doesn't touch either one.
Nearly 22,000 Exchange servers sat unpatched against a bug that can hand over every mailbox
Shadowserver counted 21,899 internet-exposed Exchange servers still unpatched against CVE-2026-62911, an authentication bypass reported by Orange Tsai of DEVCORE and fixed in Microsoft's August Patch Tuesday. About 6,200 are in the US and 5,100 in Germany, where the BSI warned that about 85% of on-premises Exchange servers remain vulnerable. Microsoft says an attacker could "take over the mailboxes of all Exchange users," reading and sending mail and downloading attachments.
The attacker needs basic privileges and some user interaction, and the bug hadn't been flagged as exploited when BleepingComputer reported on September 1. But NCSC-NL in the Netherlands says exploit code is already online, and CISA has added 20 Exchange Server vulnerabilities to its Known Exploited Vulnerabilities catalog since November 2021, 14 of them flagged as used in ransomware attacks.
The calendar is the real story. Exchange 2016 and 2019 now get security fixes only through the Extended Security Updates program, which ends in October 2026, and NCSC-NL's advice for them is to patch, restrict access to internal networks and replace the servers where you can. If you're still on either, this is close to the last fix you'll get, so the migration plan deserves the same attention as the patch.
The FBI says impersonators are winning mailbox access through genuine consent screens
An FBI public service announcement on September 1 describes a campaign, running since late 2025, that contacts prominent people, their family members and acquaintances on personal accounts through a commercial messaging app. The senders pose as officials, media or public figures sharing a file, as event planners asking the target to verify their identity through an app, or as a journalist or academic wanting a draft reviewed. The link opens the provider's genuine permission screen, and the victim approves an app the attacker controls.
That app can read and send email and reach data without the password, and MFA never comes into it. It's the genuine-consent-screen trick Check Point documented in late July, except the bait is a person rather than a Planner notice. The consent page is real, so a link checker has nothing to flag, and in your own tenants the fix is the same consent lockdown. For executives and their families, the message is simple. The access survives a password change, and only removing the app in the account's security settings revokes it.
A dark web shop claimed 153 million driver's license scans, infrared and ultraviolet images included
Brian Krebs reported on September 1 that a new identity theft service called Nexus claimed scans of more than 153 million US and Canadian driver's licenses, along with millions of other ID documents. Each record can carry six images, front and back in basic, infrared and ultraviolet versions. Krebs's evidence pointed to IDScan.net, a New Orleans identity verification company that says it runs more than 21 million verifications a month. The FBI's New Orleans field office opened an investigation, Nexus vanished the evening the story ran, and by September 4 IDScan faced lawsuits in Louisiana.
A lot of the controls behind email quietly end in "send us a photo of your ID," from help desk resets to vendor onboarding to the check after a bank detail change. These aren't phone snapshots. They include the infrared and ultraviolet captures a verification scanner takes, and once that many are for sale, an ID image proves someone has a copy of a license, not that they're the person on it. Keep the document check, but don't let it decide a reset or a payment change alone. Pair it with something nobody can buy in bulk, like a callback to a number already on file.
- Dropbox let Lenovo vouch for email addresses, and about 5,000 accounts paid for it
An issue in Lenovo's email verification let an attacker register Lenovo IDs with victims' addresses and sign into their Dropbox accounts without a password between August 4 and 21, so any identity provider allowed to vouch for an email address is part of your login.
- Invoice emails got victims to enroll their PCs in an attacker's Faronics Deploy
Huntress saw invoice and tax lures reach more than 457 endpoints between July 21 and August 20, pushing a signed Faronics Deploy installer often named Adobe.exe that let attackers run PowerShell remotely and add ScreenConnect as a backup.
- Trezor says its shipping partner kept customer data it promised to delete
The ShipMonk breach Trezor disclosed in mid-August also exposed names, email addresses, phone numbers and shipping addresses for 67,000 US Trezor customers who ordered between November 2019 and August 2021, despite written assurances of deletion, and Trezor is warning them about scam emails, calls and letters.
- X users got a wave of password reset emails
Reports began September 1 and X says it has seen no evidence of a breach, but Malwarebytes says the bigger risk may be phishing that copies the reset flow, so turn on X's password reset protection and leave the links alone.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.