Rebecca WarrenWhat's happening in email security: October 5 - October 11, 2026
This week's attacks ran the full range of scale, from one employee's mailbox all the way up to three countries' domain registries. The mailbox belonged to a Nikkei employee, and it sent 9,000 phishing emails to colleagues and to the people Nikkei's journalists interview. The registries were hijacked long enough for attackers to get real certificates issued for Google names and, per Google, for several big global brands too. And a crew posing as Taiwanese research institutes sent invitations that read like an LLM wrote them.
Nikkei's hijacked mailbox sent 9,000 phishing emails to staff and interviewees
Nikkei disclosed two separate email account compromises. In late July, someone got into an employee's Google Workspace account. Nikkei discovered it in early August after a notification from Google and changed the password. Names and email addresses for 1,646 employees and business partners may have been exposed. In September, attackers got into a different employee's Microsoft 365 account and used it to send 9,000 phishing emails. The September 30 wave carried links to malicious sites and went to internal staff and to interviewees that employees had been in contact with.
The second incident is the more instructive one. Those messages came from a real Nikkei account to people who had every reason to expect mail from Nikkei. Interviewees are the softest target here. They sit outside Nikkei's security stack, and a link from a newsroom they've already spoken to is exactly what they'd open. Nikkei hasn't named an attacker or said whether the incidents are linked. Email has cost this company before. It lost about $29 million in 2019 to a BEC attack against a Nikkei America employee.
Most email defense points inward, and this incident argues for looking the other way. One mailbox suddenly mailing thousands of links to external contacts is a loud outbound signal, so check whether anything you run would actually alert on it. And notice how the Workspace compromise came to light. Nikkei found it after a notification from Google. If your provider is your detection layer, better to know that now.
Hijacked country registries got attackers real certificates for Google domains
On October 6, Google's Chrome team disclosed that attackers had compromised the country-code TLDs for Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as), changed DNS records, and obtained unauthorized HTTPS certificates for Google domains. Certificate Transparency logs show at least 12 certificates issued between September 22 and 27 across seven names, including google.com.gh, google.sl and youtube.as. Let's Encrypt issued 11 and ZeroSSL one, and all 12 have since been revoked. Google says its own systems weren't compromised, and that CT data turned up "several leading global brands and widely used online services" believed to have been hit the same way. It didn't name them.
Think about what the attacker actually held. Whoever controls a registry controls DNS for every name under it, and DNS control is what a CA checks before issuing a certificate. The same access would also let them rewrite MX, SPF, DKIM and DMARC records for those names. Every protection you've built on a domain assumes the registry underneath it is honest. Google itself warns that "browser-side intervention should not be relied on to protect your users."
Google's advice is to monitor Certificate Transparency for all your domains, including "parked or regional ccTLD properties," and publish restrictive CAA records with ACME account bindings. CAA won't stop issuance mid-hijack, but it matters afterward because CAs can reuse a completed domain check for up to 200 days under current rules. Let's Encrypt announced the same week that it's cutting its own reuse window from 30 days to 10. Start with the country domains you registered defensively years ago and never looked at again.
AI-polished event invites are fronting a real-time Google AitM kit
Cisco Talos detailed UAT-11985, a cluster that spent mid-2026 spear-phishing people affiliated with Taiwanese research organizations. The emails invited them to policy and geopolitics events, impersonating the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute, and reused real event details. None of those organizations could confirm the senders. The registration link displayed a Google Forms URL while the actual href pointed to a phishing site on a third-party platform. The crew also doctored real event posters with malicious QR codes, which could reach new victims if someone prints one for an office bulletin board.
Behind the lure sits a real-time adversary-in-the-middle kit for Google accounts. A fake Google Form redirects to a spoofed Google login in Simplified Chinese, Traditional Chinese or English, picked from the browser's language settings. Operators push WebSocket state updates that dictate which MFA challenge screen the victim sees, a setup Talos says "effectively bypasses multi-factor authentication (MFA) to harvest complete, authenticated session tokens." It even checks whether a passkey flow is enabled and can show a passkey prompt.
The writing is what should change your training slides. All three emails Talos analyzed share the same three-part structure, heavy policy jargon and interchangeable praise, which reads like a reusable AI prompt, though Talos says it can't conclusively prove an LLM wrote them. We said last week that clumsy grammar is losing its value as a tell, and this campaign is the worked example. The mismatch between link text and destination is still an easy catch, so make sure your filtering and your people both check where a link really goes.
Fake AI ad tools wearing ChatGPT, Gemini and Claude branding are stealing ad accounts
Island researchers found a campaign pitching fake advertising products for Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse and Manus. Victims reportedly arrive through fake invitation emails impersonating those brands. Clicking "Connect" opens a browser-in-the-browser window whose fake address bar shows accounts.google.com or an Okta tenant, while the real browser stays on the phishing domain. A human operator then steers the victim through sign-in with commands like /password and /2fa and tries the credentials live.
AI brands have been steady bait since the fake Claude Desktop ads in July, but this crew wants a different prize. The targets are agency staff, media buyers and manager-account admins, because ad accounts are money. Stolen accounts, especially ones with clean spend history, are likely run for the attackers' own ads or sold. Attackers can add their own admins and demote the real owner, and recovery can take weeks or months. One domain, museads[.]ai, appeared on September 16, about a week after Meta launched Muse. That's how short the gap is between a product launch and its first fake. A quick tell from BleepingComputer's coverage is that a browser-in-the-browser window is an iframe, so it can't be dragged outside the browser or resized like a real OAuth popup.
BlueKit sells account takeover across 97 brands for $250 a week
Malwarebytes tracked BlueKit, a phishing-as-a-service kit that first appeared on a cybercrime forum in April. As of September it offered 97 brands across 176 variants, from Amazon, Booking.com, Google and Apple to Salesforce, HubSpot, GitHub, Cloudflare and Cisco. It captures device fingerprints and session cookies, includes an AI assistant that writes phishing emails and fake texts on request, and added an SMS sender in August. Operators claim you can connect a domain and have a phishing site live in about 10 minutes. It costs $250 for seven days, $480 for 14 or $940 for 30, and on August 29 the operators claimed more than 1,000 customers.
Malwarebytes' back-of-envelope math puts potential gross revenue from those 1,000 customers at $250,000 to $940,000, depending on the plan they buy. For each customer, $250 buys a week of session-stealing clones of brands your employees sign into every day. One successful BEC can cost what Nikkei lost in 2019, around $29 million. When a convincing clone costs a few hundred dollars, attackers will keep making them, and the thing that decides your exposure is how fast you spot your brand on someone else's domain.
- Microsoft fixed an Exchange flaw that lets authenticated attackers read other users' mailboxes
CVE-2026-96940 (CVSS 8.8) exposes colleagues' emails and attachments on Exchange Server Subscription Edition RTM, 2016 CU23 and 2019 CU14 and CU15, and while there's no sign of exploitation yet, Microsoft rates it "Exploitation More Likely" and has shipped out-of-band updates for on-prem servers.
- US authorities seized seven Flax Typhoon-linked domains, including outlook3650[.]com and linkedinns[.]net
The action disrupted tools including FishHub, which was allegedly used for spear-phishing and counted about 20 Taiwanese universities among confirmed victims, and the group also used a brute-force tool called EBurst against Microsoft 365 accounts.
- A Houston man got 30 months for moving BEC money through a "luxury car service"
Edikan Adiakpan's company Akama Lifestyle handled proceeds from spoofed supplier and creditor emails sent to more than 10 victims, including a Mississippi trailer company that wired $927,080 thinking it was paying its supplier.
- Phishing lures hosted on Power BI dropped rogue ScreenConnect installs
Huntress traced Outlook phishing emails to a fake reference document on app.powerbi.com, a real Microsoft domain that filters tend to trust, and a retroactive hunt found the same ScreenConnect client on 22 other endpoints.
- YouTube creators are getting fake brand deals from a phony Hollyland team
ESET found personalized "paid collaboration" emails from a fake Hollyland "Creator Partnerships team" that lead to sites like joinmatchy[.]com and a fake Google sign-in that grabs the password and one-time code, with variants posing as Nike and Spotify.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.