Rebecca WarrenWhat's happening in email security: July 6 – July 12, 2026
The phishing email is increasingly just the opening move. This week's standout attack started with a survey email and ended with a fake IT-support call on Microsoft Teams. Elsewhere, scammers impersonated Robinhood with no links at all, and the device-code and encrypted-payload techniques we've been tracking kept mutating to stay ahead of the gateway. If your email defense stops at the inbox, several of these walk right past it.
A phishing email, then a Teams call from "IT support," then a RAT
Palo Alto's Unit 42 detailed a neat, nasty chain. It opens with a phishing email, an "Employee Survey" carrying a malicious PDF. Then it pivots channels: the victim gets a Microsoft Teams call from an external tenant, `helpdesk@Progressive936.onmicrosoft[.]com`, labeled "External unfamiliar," with someone posing as a system administrator. That person talks the victim through installing legitimate remote-access tools, HopToDesk and AnyDesk, then pulls down an MSI that launches EtherRAT, a cross-platform Node.js RAT that resolves its command-and-control address through Ethereum smart contracts.
The lesson here is about scope. Your email gateway blocked, or should have blocked, only the first step. Everything after it happened on Teams and over remote-access software, where the email security stack has no visibility. Defending against this means constraining who can contact your staff on Teams from outside the organization and locking down which remote-access tools users can install. The email was the match, but the fire spread somewhere your inbox controls can't see.
"Ghost phishing" hides the payload until it's in your browser
The EvilTokens crew added AES-GCM encryption so the phishing page stays dormant and invisible to URL and content scanners until it decrypts and renders client-side. ANY.RUN had to reconstruct it at the browser DOM level. Their exposure figures are worth a glance: consulting 75.6%, financial services 72.8%, manufacturing 71.9%. Detection is being pushed out of the gateway and into the session, whether defenders are ready or not.
Robinhood callback phishing skips the link entirely
LevelBlue's SpiderLabs tracked a rise in callback phishing (TOAD) impersonating the trading platform Robinhood. The emails and texts warn of "unusual sign-in activity" and tell you to call a support number. There's no malicious link to sandbox and no attachment to detonate. The whole attack lives on the phone call, where an operator walks you out of your credentials, 2FA codes, or crypto. Researchers catalogued 14 attacker-controlled numbers, including foreign lines dressed up as US support, complete with fabricated device names and timestamps for credibility. This is the category of phishing your technology genuinely struggles to catch, which makes brand-impersonation awareness the real control.
- Device-code phishing on genuine Microsoft domains
Kaspersky documented campaigns abusing Microsoft's OAuth device authorization flow, where final authentication happens on real microsoft.com and login.microsoftonline.com pages, killing the "just check the URL" advice because the URL is legitimate, with lures posing as law-firm notices and order confirmations and the same one-line fix we have covered in recent weeks: disable the flow if your tenant doesn't use it.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.