← Email Security Weekly
Issue #028September 14, 2026
VP of Marketing, Rebecca WarrenRebecca Warren

What's happening in email security: September 7 - September 13, 2026

The most convincing phishing email of the week came from the real Trezor, through the real newsletter platform, to people who had signed up for it. A single sign-on bug at Brevo turned a marketing tool into a phishing cannon, help desk impersonators are using passkey enrollment as their excuse to call, Patch Tuesday fixed an Exchange flaw that a mailed Visio file can trigger, and Microsoft caught more than a million AI-assisted invoice emails borrowing both your CEO's name and ServiceNow's.

This Week

A Brevo SSO bug let attackers phish Trezor's customers from Trezor's own newsletter

On September 9, thousands of crypto holders got urgent security notices from companies they actually use. Trezor's read "Critical Security Alert: STM32 Entropy Vulnerability" and led to an app asking for the wallet backup. CoinTracking customers were told to refresh their API keys. BitBox subscribers got their own version. The breach wasn't at those companies. It was at their shared newsletter provider. For Trezor, it's a second vendor-side headache, days after the latest ShipMonk news.

Brevo's write-up explains how. The attacker created their own Brevo account, switched on SAML single sign-on and invited legitimate Brevo users into it. That login should have been fenced to the attacker's organization. Instead it reached every organization those users could reach. Brevo counts 138 accounts accessed, six used to send phishing and contacts exported from 43, and says the phishing passed the usual email authentication checks and looked genuine. Trezor says Brevo confirmed 347,149 of its marketing contacts were exported.

Every platform you've added to SPF or handed a DKIM key holds signing authority for your brand, so its access control is part of your perimeter now. Trezor had the phishing domain killed at DNS within 20 minutes, and 2,500 people had already clicked. List every third-party service that can send as your domains, put marketing mail on its own subdomain so you can cut one vendor off without touching corporate mail, and write the "our ESP is sending phishing" runbook before you need it.

Help desk impersonators are using passkey setup as their reason to call

The help desk callers we priced out in August are leaning on passkeys. Microsoft has tracked intrusions since May 2026 that use passkey, MFA or SSO setup as the pretext, delivered by calls and texts to personal mobiles from someone posing as IT, and occasionally by Teams messages from a colleague's already compromised account. The "setup" page is an adversary-in-the-middle proxy or a device-code flow. The crews using it include Storm-3121, linked to ShinyHunters and Falcon extortion, and Storm-3032, a BlackFile splinter running the Helix extortion brand. Arctic Wolf, tracking an overlapping cluster as PREY-0058, says its calls mainly target directors, VPs and other executives.

Passkeys are the fix for proxy-style credential phishing, and the rollout itself is now the lure. Once in, the attackers register their own phone, authenticator app or software OTP token, run automated Microsoft Graph reconnaissance with a Node.js tool, then pull steadily from SharePoint and OneDrive, and in some cases Exchange Online. Microsoft says collection generally stayed under 1,000 files or emails in any one hour, which likely helped the activity blend in with normal enterprise use.

The infrastructure gives you something to hunt. Lure URLs put the victim company's name in front of a generic passkey-themed domain, like yourcompany.setpasskey[.]com, and Arctic Wolf found hundreds of subdomains impersonating real companies. Search DNS and proxy logs for your organization's name as the leftmost label of a domain you don't own, alert on every new MFA method registration, and look for the python-httpx user agent against SharePoint and OneDrive. Then publish a rule staff can quote back at a caller, that IT never walks anyone through passkey enrollment on a personal phone.

Patch Tuesday fixed an Exchange flaw triggered by a Visio attachment, and Exchange Online stopped waiting for stragglers

Microsoft's September release fixed 973 vulnerabilities by SANS ISC's count, 113 of them critical, and Krebs notes the previous record of at least 570 was only set in July. Two email-facing bugs stand out. CVE-2026-55007 (CVSS 8.1) affects Exchange SE and Exchange 2019, and Microsoft says an unauthenticated attacker could send a crafted Visio attachment that the server processes during content indexing, with no user interaction needed. The catch is that exploitation requires the server to be under sustained memory pressure, which Microsoft says makes it hard to trigger reliably. CVE-2026-78509 is a critical Outlook heap overflow rated 9.8, and Microsoft says simply viewing a crafted message in the Reading Pane could trigger it, without the recipient opening the message or clicking anything. Neither was flagged as exploited at release.

For anyone still on Exchange 2016 or 2019, last week's ESU warning is now concrete. Born City notes the September updates for those versions are available only to organizations enrolled in the ESU program. Exchange Online's new patch floor was also scheduled to start rolling out this week. Exchange 2016 and 2019 servers that send through an OnPremises inbound connector and sit below the October 2025 final public update get throttled with 450 4.7.230 deferrals, then, if they stay unpatched, rejected with 550 5.7.230.

Microsoft is using mail flow as patch enforcement, and it expects to raise the floor again in several months, at which point only ESU-enrolled servers or Exchange SE will qualify. Check the build of every server behind your OnPremises connector this week, watch your queues for 4.7.230 deferrals, and make the ESU versus Exchange SE call before the next floor raise makes it for you.

Imitation Is the Sincerest Form of Flattery

A million AI-assisted invoices borrowed your CEO's name and ServiceNow's brand

Between August 3 and 5, Microsoft saw more than a million emails aimed at accounts payable teams, 87.7% of them to US users. Each wore two disguises. The target company's own CEO, CFO or president appeared in the display name, reply-to and signature, forwarding a fabricated exchange with ServiceNow's president over a fake annual subscription invoice personalized to the recipient's company. The ask was an ACH payment of nearly $50,000. The ServiceNow side came from service-nowinc[.]com, registered July 31, with replies routed to domainlify[.]net, registered the same day. Microsoft found no evidence that ServiceNow or anyone else named in the lures was compromised.

Microsoft saw indicators consistent with AI-assisted templates, among them extensive HTML comments, banner lines and em dashes, which we're choosing not to take personally. It's careful to add that those signs alone don't establish how much of the content AI actually wrote. Either way, the polish is the point. With clean writing, the tells left are structural, like forwarded messages with no real header data, a thread that isn't indented the way real threads are, and an executive saying "no need to copy me." Give AP a simple rule. If the vendor contact domain on an invoice doesn't match your vendor master, the payment waits. And if you sell to enterprises, watch for new registrations that bolt words like "inc" onto your name.

The Big Picture

Google says an AI agent framework built a credential theft campaign in under six hours

Google Threat Intelligence Group's latest report describes a financially motivated actor running an autonomous multi-agent framework from a compromised organization's cloud. With an AI coding chatbot, a prompt and a set of agent instructions, it planned, built and ran a mass credential harvesting campaign in less than six hours, compromising thousands of third-party credentials while the agents handled scanning, troubleshooting and IP rotation. GTIG also found an exposed server managing more than 23,800 harvested secrets, and a China-nexus group using commercial models to generate convincing spear-phishing lures. GTIG chief analyst John Hultquist put it plainly, saying "we can assume that all threat actors are using AI in some capacity."

Run the economics. Prompt to live campaign in under six hours beats most change-control cycles, and next to Microsoft's AI-assisted invoice run the conclusion writes itself. Any defense that depends on the attacker being sloppy or slow is a depreciating asset. The controls that hold their value don't care how good the lure is, things like out-of-band payment verification, phishing-resistant authentication, DMARC enforcement on every domain you own so the cheapest impersonation fails outright, and a takedown process that moves faster than the campaign does.

What Else You Need To Know
  • A Russian web developer was extradited over spoofed bank login pages bought onto search results

    Sergei Filimonov, 36, pleaded not guilty in Atlanta after extradition from Georgia, accused of a role in a scheme that bought sponsored search links to send bank customers to spoofed login domains, with the FBI counting at least 19 victims and roughly $14.6 million in confirmed losses when it seized the web3adspanels[.]org domain in December 2025.

  • BengalSEO pushed fake brand help pages to the top of Bing

    The DFIR Report traced an operation hosting fake Bitdefender Central, Vizio TV setup and gift card pages on reputable hosts like readthedocs.io and github.io, then routing visitors to tech support scam numbers or MayaBot malware.

  • A planted prompt could make ChatGPT read your Gmail and pass it to another account

    Check Point found a hidden instruction in a pasted prompt, shared chat or custom GPT could move connected Gmail data across accounts through an internal service OpenAI has since taken offline, with only a "Talked to Gmail" label after the fact, so setting connector permissions to "Always ask" is worth the extra click.

  • A cPanel mail privilege could be turned into root

    CVE-2026-67401 lets an authenticated account holder with mail-related privileges run code as root on every supported cPanel and WHM version, so if your mail sits on shared cPanel hosting, confirm your provider is on the fixed builds.

  • JSCeal rebuilds Google sessions from stolen cookies

    Check Point Research says the malware, spread through malvertising for fake TradingView installers, lifts cookies and OAuth tokens from Chromium browsers and replays the session to get into a victim's Google account without going back through authentication.

This roundup is published weekly by Red Sift. Test your email authentication set-up with Red Sift Investigate.