Rebecca WarrenWhat's happening in email security: August 3 - August 9, 2026
Black Hat week usually produces one piece of research that quietly invalidates an assumption everyone was resting on. This year it was the idea that an email stays inside the reading pane. Alongside that, an adversary-in-the-middle campaign went hunting specifically through payroll and finance mailboxes, Kaspersky put numbers on how much phishing now runs from cloud platforms your allowlist trusts, and the IRS warned about a scam that arrives on paper.
An AitM campaign is holding Microsoft 365 sessions open to read payroll and finance mail
Arctic Wolf Labs is tracking an active adversary-in-the-middle campaign against Microsoft 365 that starts with a voicemail-themed phishing email and ends with attackers reading through invoices, payments, banking, and benefits mail. The path between those two points is worth walking. The lure runs through a six-stage redirection chain that hops across Google Meet, Google Ads, Amazon S3, and Campaign Manager before landing on the decoy page, which proxies the real Microsoft login and captures the password and the MFA code as they go past.
What happens next is the interesting part. Rather than re-phishing the victim, the operators keep the stolen session alive, refreshing it at roughly eight-hour intervals and routing the sign-ins through rotating residential proxies so they read as ordinary consumer traffic. Their JavaScript fingerprints the victim's browser, screen dimensions, timezone, and WebGL vendor, and the pages query api.country[.]is for the victim's country code, which Arctic Wolf suspects is used to pick a proxy in the victim's own country. That combination looks built to slip past impossible-travel alerting, which is the control most tenants are quietly relying on to catch exactly this.
Arctic Wolf observed hundreds of organizations targeted by email in July, across healthcare, education, manufacturing, government, and professional services in the US, Canada, and Europe, with tactical overlaps with the Payroll Pirate activity Microsoft tracks as Storm-2755. There is one detection tell worth taking straight to your SOC. The proxy infrastructure produces implausible browser and operating-system pairings in sign-in logs, things like mobile Safari on Windows 10. That is a hunt you can run this afternoon against your Entra sign-in data, and it does not need a new product to answer.
Black Hat research shows CSS in an email can rewrite the webmail page around it
Gareth Heyes of PortSwigger presented work at Black Hat USA 2026 demonstrating that styling inside a message can escape the message boundary and reach into the webmail interface itself, with colleague Pete Hendy contributing the AI-assistant exfiltration chain. The techniques include label-jacking in Outlook, a set of CSS mutation bugs, an image-set() bypass, CSS hotwiring, an image-proxy bypass, and a click-driven method that leaks which digits a numeric token contains and how often each appears. Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail were all affected by at least one of them.
The consequences run from spoofed sign-in screens that harvest passwords, to theft of authentication tokens, including a Medium login token sent by email and, where an AI assistant is connected to the mailbox, a Slack token lifted through indirect prompt injection once the victim asked the assistant to process their mail, to leaking the reader's IP address. Consider what a spoofed sign-in screen means here. It is not a convincing copy hosted somewhere else. It is your actual webmail client, on the correct domain, redrawn by a stylesheet the attacker mailed you. Nearly all user training assumes the fake thing and the real thing are two separate pages, and that the job is telling them apart. Here they are the same page.
Fastmail has fixed two CSS mutation bugs and Proton Mail's proxy bypass stopped working during retesting, but the Outlook label-jacking issue and Gmail's image-set() bypass were both still live when the research went public, and the proof-of-concept code is in PortSwigger's public GitHub repository. That last detail sets the clock. This one is a provider patching problem rather than something you can configure your way out of, so the useful moves are watching your provider's advisories, and treating any user report of webmail behaving oddly as a security ticket rather than an IT annoyance.
Kaspersky blocked nearly 225,000 phishing domains on cloud platforms your filters already trust
Kaspersky's Olga Altukhova measured where phishing pages actually live now, and the answer is developer cloud platforms. Between August 2025 and July 2026 Kaspersky blocked 224,984 unique third-level domains on cloud and decentralized services used in phishing attacks, and over the same 12 months it identified more than 390,000 phishing pages hosted on legitimate cloud platforms and IPFS. Cloudflare Pages alone accounted for 24.9 percent of phishing links, followed by Vercel at 13.8 percent, GitHub Pages at 13.7 percent, and Netlify at 10.0 percent, with IPFS gateways, Cloudflare Workers, Wix Studio, Webflow, and Azure rounding out the top ten. Free tiers with almost no verification, a global CDN in front, and a parent domain nobody can afford to block is a combination attackers were always going to find.
The kit Altukhova pulled apart is a good illustration of why hosting reputation stopped being useful on its own. A fake CAPTCHA page collects the target's address from the URL hash, where network inspection will not see it. A real CAPTCHA then checks that a person rather than a security sandbox is on the page, after which the page registers a service worker in the victim's browser running Ultraviolet, a legitimate open-source web proxy library, to rewrite every link and form. The final stage is a browser-in-browser pop-up with a drawn-on address bar, showing the genuine login page routed through that proxy, and the script lifts the credentials and the session tokens together.
For defenders the practical takeaway is a scoping question rather than a blocklist. Ask which of these platforms your organization genuinely needs to reach, because for most companies the honest answer for the IPFS gateways and several of the static hosts is that no business process depends on them. Narrowing that set turns a domain nobody can block into a domain you specifically do not need.
The IRS is warning about fake tax letters that arrive in the post
IRS Criminal Investigation has issued a fraud alert about letters, real ones, in unmarked envelopes, impersonating Department of the Treasury correspondence out of Austin, Texas. They carry a plausible notice number, CP14-432RA, and a reference to tax years 2017 to 2026, and they instruct cryptocurrency holders to register with a "Digital Asset Compliance Portal" by scanning a QR code. The code leads to a site wearing IRS branding, complete with a banner claiming to be an official website of the United States government, which asks where the recipient keeps their crypto, invites them to estimate their holdings in bands topping out at $100,000 and above, and collects a phone number for verification. The follow-up call is where the operators go after passwords, recovery phrases, and 2FA codes.
Coinbase's security team and the threat intelligence firm DarkTower traced the infrastructure, finding the domain registered through a Hong Kong registrar days before the letters went out and hosted in Romania on infrastructure previously used for banking phishing. Note how little of this an email program can influence. There was no message to filter, no sender to authenticate, and no link to detonate. What the impersonated organization can still act on is the imposter domain and the speed of the public warning. If your brand is impersonation bait, the capability that matters here is knowing a fraudulent site exists while it is still days old, and having a way to tell customers before the phone calls start.
Google put a price tag on help desk impersonation, and it is more than $10.6 million
Google Threat Intelligence Group and Mandiant published a profile of UNC6671, an extortion crew that calls enterprise staff, often on their personal mobile phones, poses as the IT help desk running a security migration, and steers them onto spoofed login portals where adversary-in-the-middle infrastructure takes the credentials and MFA tokens. Persistence comes from registering the attackers' own MFA device once they are in, after removing the legitimate one. Microsoft 365 and Okta environments are among the targets, and the group now runs its extortion under several public brands, Redact, Pink, Helix, and Falcon, after announcing the retirement of its BlackFile name in May.
Last week IBM ranked social engineering like help desk impersonation the second-costliest way into a breach. Google's accounting shows what that looks like from the attacker's side of the ledger. Between January 7 and May 12 this year Google traced more than $10.6 million in Bitcoin to wallets tied to the group. Opening demands typically range from $1 million to more than $3 million and are often negotiated down by 50 to 75 percent, and in more than 53 percent of tracked cases final payments averaged $750,000. Read those figures as a market signal. Calling an employee and asking nicely, with a convincing story about a migration, brought in eight figures in roughly four months, which tells you how much investment is going to keep flowing into it. The counterweight is unglamorous and organizational rather than technical. Your help desk needs a verification procedure nobody can talk their way around, staff need a route to check that an unexpected call is genuine, and MFA device changes need to generate an alert somebody actually reads, on removals as much as on new enrollments.
- The Kali365 device-code kit is still busy
ANY.RUN's telemetry records more than 80 public sandbox sessions a week tied to Kali365, the phishing-as-a-service kit the FBI warned about in May, which dresses its lures as SharePoint, OneDrive, and DocuSign before sending victims, mostly in the US, to Microsoft's genuine device login page to approve an attacker-supplied code.
- 77 fake VS Code extensions were pulled from Open VSX
Manifold Security found extensions that copied the names, namespaces, and descriptions of genuine Microsoft marketplace packages while publishing from unrelated accounts, uploaded between July 26 and August 1 and removed by August 3, with 58 sending back the hostname and in some cases workspace or editor details and 19 running fuller reconnaissance, all of them reporting to a single domain registered eleven days before the campaign began.
- The Snowflake extortionist pleaded guilty
Connor Riley Moucka, 26, of Kitchener, Ontario, admitted computer fraud, wire fraud, aggravated identity theft, and conspiracy over a campaign that hit at least 165 Snowflake customers and netted over $2.5 million in ransoms, all of it built on stolen credentials for accounts that did not enforce multi-factor authentication, with sentencing set for October 27.
- A macOS ClickFix campaign got good at hiding from analysts
Microsoft tracked more than 250 front-end domains in a campaign that moved from serving its lure openly to a 2.5 KB client-side fingerprinting script feeding a server-side gate, reading WebGL GPU signals and timezone and instrumentation checks to tell real Apple hardware from a sandbox, so analysts and detonation services get a harmless decoy while genuine Mac visitors get the lure that delivers MacSync or Atomic Stealer.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.