← Email Security Weekly
Issue #025August 24, 2026
VP of Marketing, Rebecca WarrenRebecca Warren

What's happening in email security: August 17 - August 23, 2026

It's back-to-school season, and attackers did their homework. Russian espionage crews spent the summer talking academics and defense staff into handing over app passwords and WhatsApp sessions, Check Point counted nearly 19,000 new education-themed domains in July alone, and the Justice Department put 17 names on a phishing operation that compromised about 8,000 professor mailboxes. Off campus, a Zimbra flaw let attackers run commands on mail servers using crafted SMTP requests, and two unrelated malware families decided the best place to ask for a password is a fake Windows lock screen.

This Week

Attackers are running commands on Zimbra servers with nothing but crafted SMTP requests

CERT Polska warned this week that attackers are actively exploiting CVE-2026-73570, a command injection flaw in Zimbra Collaboration rated CVSS 8.9. The bug lives in how Zimbra processes SNMP notifications, and according to the NVD description an unauthenticated attacker can send specially crafted SMTP requests that can result in arbitrary operating system commands running as the zimbra user. No login, no click, no phishing email for anyone to report, just a mail server accepting mail.

There's a condition attached. The flaw only bites when the optional zimbra-snmp package is installed and SNMP notifications are switched on, which shrinks the exposure but is exactly the kind of setting nobody remembers enabling. Zimbra fixed it in 10.1.20, released in July. CISA added it to the Known Exploited Vulnerabilities catalog on August 21, and Shadowserver was counting 267 compromised instances by August 24, down from a peak of 274.

This is the second exploited Zimbra bug we've covered in a month, after the LAUNDRY BEAR zero-click campaign in July. If you run ZCS, upgrade to 10.1.20 or later and then run CERT Polska's checks anyway. Look for suspicious Zimbra service restarts in /var/log/zimbra.log and for files created in the last 30 days under /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/ and /tmp/. A server patched in August but compromised in July is still compromised.

Russian spies are talking academics out of app passwords, OAuth tokens and WhatsApp sessions

Google Threat Intelligence Group profiled three suspected Russian espionage clusters, UNC6293, UNC7005 and UNC5976, that go after academics and think tanks in Europe and the US, plus aerospace, defense and government staff in Europe. They don't exploit software. They abuse login features that work exactly as designed. UNC6293, which GTIG ties to APT29 with moderate confidence, has posed as the US State Department and walked targets through creating an app password named ms.state.gov, then asked them to hand it over, first by email and more recently through a form on a legitimate-looking website. An app password is built to work without a second factor, which is precisely why they want one. UNC7005 registered domains spoofing the Finnish Operations Center from July 31 and emailed people connected to the European defense industry between August 6 and August 13, routing them through a genuine Google sign-in into an attacker-controlled, unverified cloud project that GTIG says was likely used to steal their tokens.

The WhatsApp technique is the one to show your executives. A phishing page asked for a phone number, generated a real WhatsApp device-link request to the attacker's own device, and displayed the genuine QR code and linking code with instructions. Follow them and the attacker becomes a linked device on your account. UNC5976 runs a similar play against Google accounts with fake file-sharing pages, and it stood up at least twelve new domains in about three months after Google first disrupted it.

Each of these leans on a genuine Google or WhatsApp screen at the critical moment, so the page a target is most likely to scrutinize is the one that's real. The app password piece has a concrete fix. GTIG notes that Google's enterprise customers can disable app-specific passwords by restricting 2-Step Verification to Only Security Keys or enrolling users in the Advanced Protection Program, and says plainly that app passwords are unnecessary in most cases. For staff who speak at or attend conferences, audit existing app passwords and OAuth grants this week, and add a check of WhatsApp linked devices to your executive response playbook.

Two new Teams help desk scams both end at a fake Windows lock screen

Expel's Marcus Hutchins analyzed SynkLoader, a new malware framework pushed through the fake-IT Teams messages we've tracked since early July, with attackers posing as the target company's own help desk. Victims are told to install a fake "PowerShell Cleaner" MSI hosted in Microsoft Azure, which unpacks a Python framework with seven modules, including a reverse proxy, remote desktop streaming, and one called PhishLocker that draws a convincing Windows 11 lock screen to capture the account password.

Earlier in the week Ontinue described TWINLOOT, a separate Python implant it found while investigating an ongoing campaign in July. Same opening, an attacker on Teams posing as IT support who talks the target into running a PowerShell command. Same payoff, too. Its credz_waiting command throws up a fake Windows lock screen that answers whatever is typed with "The password is incorrect. Try again," nudging the victim to enter it a second time. Its commands arrive through a SharePoint drive polled every 15 seconds over Microsoft Graph, so much of its traffic looks like Microsoft 365 talking to itself.

Two unrelated toolsets landing on the same trick in one week is a signal. Users have been drilled to distrust login pages in a browser. Nobody drills them to distrust the lock screen, which belongs to the operating system and gets their password every day. Expel's advice makes a good one-line training note. When a lock screen appears at an odd moment, try Ctrl+Alt+Delete or Alt+Tab, since SynkLoader's version is just a full-screen window. Upstream, review which outside tenants can start a Teams chat with your staff, and agree on how a genuine IT contact proves who they are, so people have something better to go on than a display name.

Imitation Is the Sincerest Form of Flattery

Nearly 19,000 education-themed domains were registered in July, and a growing share are malicious

Check Point Research counted 18,954 newly registered education-themed domains in July, up 5% on June, and the malicious share rose from one in 305 in June to one in 226. Some are generic enough to fool almost anyone, such as education-gov[.]com, students-portal[.]com and checkmyschool[.]org. Others arrived in batches that look automated, including ten student-loan domains numbered by year from 2026 to 2035. The lures borrow other people's names freely. One site, studentdiscount[.]online, dressed up as a Target student rewards promotion promising $750, and school-branded PDFs routed readers through compromised websites to fake Microsoft 365 and OneDrive login pages.

If you defend a school, a university or an education brand, you're being impersonated two ways at once. There's your specific name, and there's the category, where an attacker doesn't need to copy your domain because "student portal" already sounds like you. Education organizations averaged 4,696 attacks per organization per week from January to July, more than double the cross-industry average. The monitoring that pays off looks for your institution's name paired with words like portal, login and student, and starts well before term does.

The Big Picture

The US charged 17 Iranians over a phishing operation that turned 8,000 professor mailboxes into a product

The Justice Department announced a 14-count superseding indictment on August 18 charging 17 members of the Mabna Institute, an Iran-based company it says worked partly on behalf of the IRGC. Nine of them were first charged in 2018. The core allegation is a university spearphishing campaign that ran from about 2013 through at least December 2017, targeted more than 100,000 professor accounts and compromised about 8,000 of them. Victims included 144 US universities and 178 universities abroad. More than 31 terabytes of academic data walked out, material US universities had spent more than $3.4 billion to procure and access.

What puts this in the big picture is what happened to the access afterward. According to the DOJ, a site called Gigapaper.ir sold customers in Iran access to university online library systems using the compromised professor accounts. That's a subscription business with stolen logins as the inventory, and it only works for as long as nobody notices those logins being reused. The State Department is offering up to $10 million for information on five defendants, and the FBI's Brett Leatherman said "the FBI's memory is long." The useful question for any university or research organization is whether you'd notice a valid faculty login being used from somewhere it shouldn't be, months after the phish that produced it.

What Else You Need To Know

This roundup is published weekly by Red Sift. Test your email authentication set-up with Red Sift Investigate.