Rebecca WarrenWhat's happening in email security: July 20 - July 26, 2026
This was a week about email infrastructure, the servers and gateways and login pages that sit underneath the inbox. Russian operatives read three months of a target's mail without the victim clicking anything, police pulled the plug on a phishing platform that armed more than 1,800 criminal crews, and attackers turned hotel Wi-Fi into a way to steal Microsoft 365 logins from travelers. The lures matter, but so does everything the lure runs on.
Russian LAUNDRY BEAR read 90 days of email with a zero-click Zimbra flaw
A joint CISA advisory, AA26-204a published July 23, attributes a webmail espionage campaign to LAUNDRY BEAR, a Russian state-supported group also tracked as Void Blizzard. The technique is what sets this one apart. It exploits CVE-2025-66376, a stored cross-site scripting flaw in the Zimbra Collaboration Suite Classic webmail interface, and the victim never has to click a link or open an attachment. Simply viewing the malicious message is enough to run the attacker's JavaScript inside the webmail session.
Once it fires, it goes after the previous 90 days of email, the full organizational email directory, browser-saved passwords, and two-factor recovery codes. That last item is the sting. Stolen recovery codes, plus an app-specific password the payload creates, can outlive a password reset, which is why the advisory tells organizations to revoke every app passcode and 2FA scratch key. Treating this as "just phishing" undersells it. Zimbra patched the bug back on November 6, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog in March, but LAUNDRY BEAR had been exploiting it as a zero-day since at least July 2025, months before the fix existed. Targets span government, defense, and other organizations across Western countries and Ukraine. If you run Zimbra Collaboration, versions 10.0 before 10.0.18 or 10.1 before 10.1.13 are exposed, and patching your internet-facing mail server is the whole ballgame here.
Police dismantled the Kratos phishing platform and seized more than 200 servers
Some good news for once. German and US authorities ran Operation Olympus Blade against Kratos, a phishing-as-a-service platform, seizing more than 200 servers and arresting its alleged developer and technical administrator in Indonesia. The FBI now holds the service's domain. Kratos existed to let low-skill criminals spin up convincing fake Microsoft login pages that harvested usernames, passwords, and session cookies. Grabbing the session cookie is what let operators walk straight past multi-factor authentication and into the account.
The scale explains why the takedown matters. More than 1,800 criminal customers used Kratos to run about 15,000 phishing campaigns a month, with confirmed victims across 35 countries and, by some reports, hundreds of thousands of people targeted. Platforms like this are the reason adversary-in-the-middle phishing became a commodity, so knocking one offline, and arresting the person allegedly behind it, is a real dent rather than a symbolic one.
Hotel Wi-Fi is now a way into your Microsoft 365 account
ReliaQuest documented a campaign that skips the phishing email entirely. Attackers compromise the Wi-Fi gateways at hotels and conference centers, poison the DNS so that traveling staff who connect get redirected to fake Microsoft login pages, and harvest credentials from there. In a limited number of cases they did not bother with passwords at all, pairing the redirect with abuse of Microsoft's device-code sign-in so that Microsoft itself issued valid OAuth tokens to the attacker once the victim approved the prompt.
The uncomfortable lesson is that the trust boundary is not just your inbox, it is the network your people join when they travel. Activity has been running since at least June across US cities, India, and Saudi Arabia, hitting financial services, legal, healthcare, and energy staff, and ReliaQuest says the tradecraft resembles past APT28 router campaigns, though it stops short of attributing this one. An always-on, full-tunnel VPN takes the hotel's DNS out of the picture, phishing-resistant MFA defeats the fake login page, and blocking the device-code flow closes the other route, since that approval happens on Microsoft's genuine sign-in page where even a hardware key won't save you.
Fake Claude Desktop ads rode claude.ai to deliver a RAT
Huntress tracked a campaign it calls FakeAgent that impersonated Anthropic's Claude Desktop app. Users searching Bing for the app hit a sponsored ad that led to a malicious public Claude Artifact hosted on the legitimate claude.ai domain, which then redirected to an attacker-controlled download of a fake ClaudeDesktop.exe. The payload was SectopRAT, a remote-access trojan that lifts browser logins, cookies, autofill data, credit cards, passwords, and files.
We flagged fake-Claude lure pages last week, and this is the more developed version of that trend. What makes it sharp is where the redirect lived. Hosting the lure as an artifact on Anthropic's own domain borrows the vendor's reputation, so a cautious user who checks the URL sees claude.ai and relaxes. The artifact racked up roughly 7,100 views and hit at least 29 organizations over July 21 and 22 before Anthropic pulled it. When a brand offers user-generated hosting, that hosting becomes part of the brand's attack surface, and impersonation defense has to watch the trusted domain as closely as the lookalikes.
Microsoft's Q2 data shows phishing shifting out of the inbox and into the call
Microsoft's quarterly email telemetry, published July 23, counts roughly 7.6 billion email-based phishing threats, with monthly volume sliding from 2.7 billion in April to 2.4 billion in June. Several signature techniques fell hard. Its March disruption of the Tycoon2FA platform cut the phishing volume linked to that operation by 92 percent, malicious PDFs carrying QR codes dropped more than 60 percent between April and June, and CAPTCHA-gated phishing fell more than 80 percent from its March peak.
Do not read that as attackers giving up. Weekly malicious Microsoft Teams call attempts have climbed about 80 percent since the start of the year and now run near ten times their mid-2025 baseline. The techniques a gateway can fingerprint are falling, and the effort looks to be relocating to voice and chat where your email controls have no line of sight. That is the same shift behind the fake-IT-support-call chains we covered earlier this month, and it means your defensive attention has to follow the attackers off email rather than staying parked on the inbox.
- Check Point says ChatGPT cracked the top ten most-impersonated brands
Microsoft still leads brand phishing at 23 percent of attempts with LinkedIn, Google, Apple, and Amazon rounding out a top five that is more than half of all activity, but OpenAI's ChatGPT entering the ranking for the first time is the signal that impersonation is chasing AI-service trust.
- Microsoft disclosed a critical Exchange Online flaw it had already fixed, CVE-2026-56191
Microsoft rates the improper authentication bug CVSS 10.0 and says an unauthorized attacker could have used it to tamper with Exchange Online over the network, but it was not exploited and is already fully mitigated on Microsoft's side, so unlike last week's on-prem Exchange OWA patch there is nothing for customers to install.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.