Rebecca WarrenWhat's happening in email security: September 28 - October 4, 2026
DMARC had a strange week. In one story it passed mail it should have stopped, because Apple's own pipeline was signing forged iCloud senders. In another it correctly failed a spoof, and the message landed anyway because the impersonated domain sat at p=none. Around those two, FortiMail was exploited before Fortinet had fixed builds out for most versions, Star Blizzard kept mailing think tank invitations no think tank sent, and Microsoft says phishing's share of initial access more than tripled in a year.
Apple's iCloud signed forged senders, so spoofed mail passed SPF, DKIM, and DMARC
On October 1, SEC Consult's Timo Longin published two techniques that let an authenticated iCloud user send mail showing any @icloud.com address in the From header, with SPF, DKIM, and DMARC all passing. The cause was two components in Apple's outbound pipeline that disagreed about what the headers said. The first parser checked the legitimate address, the second acted on the forged one, and DKIM signing happened after the second. One technique used bare carriage returns around the From header's colon. The other, which Longin calls dot-peeling, exploited the first parser ignoring the SMTP dot-stuffing rules in RFC 5321.
Read the timeline slowly. Longin reported the problem in May 2024 and Apple paid a $15,000 bounty that November. In December 2024 he found Apple's deployed fix only blacklisted the proof-of-concept substring "admin" in the From header, leaving security@icloud.com and most other addresses spoofable. Bypasses still worked in June and October 2025, and SEC Consult didn't confirm a full fix until December 9, 2025.
It's fixed, but the lesson isn't. DMARC confirmed that icloud.com authorized the server and that the signature was valid, and both were true. On a shared consumer domain, that's a statement about Apple's servers, and DMARC has no opinion on which of Apple's customers wrote the From line. Longin's practical tips hold up. On iCloud mail the Return-Path and From normally match, so a mismatch is an easy signal, and the raw headers still carry traces of the address that actually sent it. As he puts it, sender identity in email "will most likely remain far less solid than most users assume."
DMARC caught a China-nexus spear-phish and p=none let it through anyway
Cisco Talos published research on September 30 on UAT-11587, a cluster it assesses with high confidence as China-nexus. Between September 2025 and July 2026 it affected or targeted at least 16 government and policy organizations across eight Asian countries with a new Rust backdoor called Antino, compromising about 350 endpoints.
Look at how the message Talos reviewed got delivered. The mail went out through Migadu with an attacker-controlled domain, osc-cdn[.]com, as the envelope sender, while the visible From header showed the organization being impersonated. SPF passed for the attacker's domain. DMARC spotted the misalignment and failed the message. Then the receiving provider delivered it to the inbox, because the impersonated domain published p=none, which asks for monitoring rather than quarantine or rejection. Every check worked except the one the domain owner never switched on. Inside, the actor rebuilt Gmail's attachment card from four inline Base64 PNG images, so the "attachment" was really a link to Cloudflare Pages and a five-stage chain ending in Antino.
Antino then skips running its own server. It uses Microsoft Graph to poll an attacker's Outlook folder every 10 seconds for messages whose subject starts with command_req_ plus a session ID, and moves files through OneDrive. If your domain still sits at p=none, this is the scenario you're leaving open, with your name on the From line and someone else's backdoor behind the link. Your aggregate reports will show which legitimate senders need fixing before you move to quarantine, so start there.
FortiMail was exploited as a zero-day before most versions had a fixed build
Fortinet warned on October 1 about CVE-2026-104286, a CVSS 9.8 path traversal and NULL byte flaw in FortiMail that lets an unauthenticated attacker write arbitrary files to the underlying system with crafted HTTP or HTTPS requests. It was already being exploited. Fortinet's own Product Security team found it, and CISA added it to the Known Exploited Vulnerabilities catalog the same day with an October 4 deadline for federal agencies.
Patch status was the problem. Fortinet's guidance for 7.2 is to move to the 7.4 branch, but at disclosure the fixed builds for 7.4, 7.6, and 8.0 were still listed as upcoming. Fortinet's advisory has since been updated and now lists 7.4.9, 7.6.7, and 8.0.2 as the fixes. Until you're on one, the workarounds are disabling IBE support and keeping the exposed web interface off the internet or limited to trusted private networks. Coming a little over two weeks after Cisco's Secure Email Gateway bug, FortiMail makes two exploited mail appliances in a month, and this time the way in is the web interface.
Check Fortinet's indicators even after patching. Look for added files including /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, and /data/etc/ld.so.preload, connections involving 79.141.169[.]187 or 45.129.0[.]192, and an archive account named archive234 pointed at that first address. Anyone who could write files to the appliance handling your mail could read that mail too, which is why the indicators matter as much as the version number.
Star Blizzard's fake invitations name real think tanks as hosts
Microsoft says the FSB-linked group has run at least 13 large-scale phishing campaigns since January, affecting more than 100 organizations mostly in the US and UK, aimed at Ukrainian institutions and the NGOs, think tanks, and governments backing Ukraine. Lures moved from tax audit notices to conference and roundtable invitations themed on IISS, Chatham House, and the Atlantic Council. The first email usually has no attachment. Only after a reply does a password-protected archive arrive, with the password sent as an image, and the new RedFlick chain, built around a shortcut disguised as a PDF, needs a single user interaction where the group's old ClickFix lures needed several steps.
The sending infrastructure changed too. Since March the group has mailed from accounts on compromised cPanel and WordPress websites rather than mainly from free providers like Proton. The think tanks being impersonated have no view of any of it, because the mail never touches their domains. Microsoft's best user tip is quick. Check whether the organization's name appears only in the sender's username instead of the actual domain. For your SOC, a harmless first contact followed by an archive with an image-borne password is a distinctive sequence to hunt.
Microsoft's annual report says phishing's share of initial access more than tripled
The 2026 Microsoft Digital Defense Report, published October 1, has the number to bring to your next budget conversation. Phishing as an initial access technique rose from 7% of incidents in 2025 to 23% in 2026, with generative AI that writes convincing, personalized phishing at scale likely part of the reason. SecurityWeek's read of the same report adds that Teams vishing climbed 502%.
A lot of the past two years' conversation has been about everything around the inbox, from help desk calls to stolen tokens to exposed edge devices. Microsoft's own caseload backs up Gartner's survey from last week. Email is still a front door, and a busier one. If AI-written lures are part of why, clumsy grammar and generic greetings are worth less in awareness training than they used to be. On the email side, the response is the one from the p=none story above. Get your domains to enforcement, and make reporting a suspicious message faster than deleting it.
- Two former airmen got a combined 189 months for BEC run from Dover Air Force Base
Chijioke Timothy Odimegwu and Harafat Mogaji phished employee email credentials and used spoofed addresses mimicking business partners to redirect payments, including a wire of more than $1.68 million from an Iowa City victim. It's one more case for the callback rule on payment changes.
- Phishing emails are installing two remote management tools at once
Microsoft tracked July campaigns that delivered a legitimately signed MSP360 RMM installer named like Zoom setups and SSA statements, which then quietly installed ConnectWise ScreenConnect as a second channel. If MSP360 isn't on your approved RMM list, go looking for it.
- Microsoft mapped what attackers did after exploiting the Zimbra SNMP flaw
Following up on August's CVE-2026-73570, Microsoft found attackers pulling zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret, reading mail, and trying to ship mailbox backups to Azure Blob storage. Upgrading to 10.1.20 doesn't undo stolen secrets, so rotate the preauth keys too.
- Kiteworks patched a max-severity flaw in its Email Protection Gateway
Days after telling customers to shut down their servers over a feared zero-day, Kiteworks shipped fixes for 126 vulnerabilities, led by CVE-2026-54154, an unauthenticated, no-interaction flaw that can chain to root control of any Email Protection Gateway release before 9.4.1.
- Microsoft's own X account was hijacked to pump a Clippy-branded crypto token
The @Microsoft account, with more than 13 million followers, reposted an impersonator called @clippymsftcto before another account promoted a $Clippy token, and Microsoft confirmed posts "that did not come from Microsoft." Your company's social logins deserve the same MFA and offboarding discipline as your email admin accounts.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.