What's happening in email security: August 24

This Week

NovaCookies rides genuine Docusign envelopes to steal Microsoft 365 sessions

Island researcher Shachar Gritzman published a teardown of NovaCookies, an adversary-in-the-middle kit advertised at $320 a month that relays Microsoft 365 sign-ins in real time and captures the session once the victim has entered a password and cleared MFA. The delivery is the clever bit. The strongest chain Island observed used genuine Docusign envelopes that opened in the real Docusign viewer, and inside sat a counterfeit share notice, in one case an accounting department "sharing" a remittance-advice PDF. Island's view is that everything at that layer could pass normal sender-authentication and reputation checks, because it was a real Docusign message. The malicious link lived inside the document, one level below where most mail inspection stops looking.

The rest of the chain borrows trust too. Some clicks pass through a genuine Entra authorization URL with prompt=none, which forwards the browser to a redirect URI in an attacker-controlled app without issuing a token or showing a consent screen. A Cloudflare gate, client-side proof of work and debugger-timing checks help it dodge automated analysis. Island's IOC release lists 755 domains, and nearly 90 percent of the organizations in its reviewed set were tied to lures on .vu domains.

So judge your exposure by what happens after the click, not by whether your gateway flagged the email. That .vu concentration is a gift, since very few organizations have a business reason to browse those domains. Check how your proxy and link rewriting treat the TLD and who in your tenant has visited one lately. And if a relay completes, Island's advice is to treat it as possible session theft, revoking sessions and reviewing MFA methods, OAuth grants and inbox rules, not just resetting the password.

McKesson's breach reportedly involved a ShinyHunters-style .claims lookalike

McKesson says attackers got into third-party applications and stole data in an incident it discovered on August 25, and it has disclosed the breach in a Form 8-K filing. ShinyHunters told BleepingComputer it vished several employees, compromised their Okta single sign-on accounts and moved into Salesforce and Snowflake, where it claims to have pulled about 1TB over four days and roughly 284 million patient-related records, counted as raw lines rather than unique people. It says it demanded $55,236,150. None of that is verified, and McKesson hasn't said what was taken. The lookalike angle came from a BleepingComputer source, who said the attackers used a mckesson[.]claims domain.

That pattern already had a name. On August 22 a caller posing as a named member of ReliaQuest's security team phoned several of its employees and tried to steer them to a fake single sign-on page on a domain sources identified as reliaquest[.]claims. One employee entered a password and approved the MFA push. ReliaQuest's own researchers had warned days earlier that ShinyHunters was registering domains on a company[.]claims pattern to impersonate help desks, IT staff and legal teams. What limited the damage was device trust. The attacker got a view-only session in the identity dashboard, and device-trust controls blocked its later attempts to open applications from a machine the company didn't already trust.

There are two jobs here. Look up your own brand under .claims today, then under the other new TLDs a stressed employee would find plausible, and get newly observed domains carrying your name in front of whoever owns your SSO. Then ask what a valid password plus an approved push buys an attacker in your environment. At ReliaQuest it bought one read-only screen. If your honest answer is Salesforce, that's the gap this campaign was built for.

CISA's red team phished from an internal address, then read the SOC's mail through an app

CISA advisory AA26-237A, released August 25, describes two simultaneous red team assessments against a government services organization and a water utility, and both ended in full domain compromise. Email was the way in at both. At Organization A, a web application still running default credentials for several built-in accounts let the team send mail from an internal address, and phishing from it put them on four workstations while the SOC, buried in false positives, never acted on the alerts it did get. At Organization B, three users clicked a spearphishing link, and the SOC isolated those machines within 10, 2 and 20 minutes. The team still took the domain.

How they read mail should send you straight to the Entra portal. Organization A had apps holding Mail.Read and Mail.ReadWrite, and the team compromised an app owner, added a client secret, and used the app's identity to read email, SOC staff included. At Organization B, an app that could read, write and send mail for every user in the tenant was owned by a disabled, AD-synced account. The team reactivated that account, added a secret and could pull every mailbox. Neither organization had Conditional Access for workload identities.

CISA's findings turn into a short checklist. List every app holding tenant-wide mail permissions, check who owns each one (a disabled owner is a finding by itself), and review new secrets or certificates on existing apps, which CISA names directly. Then look at anything that can send as an internal user, because mail from your own domain skips every external-sender check you've built.

Imitation Is the Sincerest Form of Flattery

Fake Microsoft scan pages tell victims to uninstall their antivirus, then line up a refund call

Malwarebytes found eleven sites on a single host that call themselves SysScan, carry Microsoft branding and offer to check whether your antivirus is working. The scan reads real browser details like the user agent, screen size, device memory and processor count, which makes it look thorough, but a website can't check for malware or missing patches, and the score is fixed in the code between 13 and 30 out of 100. Nobody passes. The verdict is that your antivirus is the problem, that Windows supposedly no longer supports third-party products, and that you should uninstall it immediately. Microsoft does still support them.

Then comes the refund. A form asks for a name, address, phone numbers, bank name, a cryptocurrency username and the ID and password for a remote-access session, and it also requires an Agent ID and Agent Name, which Malwarebytes reads as a strong sign an operator fills it in during a call. Submissions go to a Telegram group, and the victim is told a refund manager will call within three to five minutes. The pages can also switch branding depending on the operating system they detect, so the Microsoft look is simply whatever fits the visitor's machine. Put one line in your awareness material. No real security check, from Microsoft or anyone else, will tell you to remove your antivirus or hand over a remote-access login. And an endpoint agent being uninstalled right after a browser session deserves an alert of its own.

The Big Picture

APWG counted more than a million phishing attacks in Q2, and June was the busiest month since 2023

The Anti-Phishing Working Group's Q2 2026 report, published August 28, counted 1,069,681 phishing attacks between April and June, up 10.1 percent from 971,181 in Q1. June alone hit 425,808, the busiest month since April 2023. Variety is the figure to watch. Unique phishing email campaigns went from 18,666 in April to 45,156 in June, more than doubling inside one quarter, and APWG logged 941 distinct targeted brands, half of them hit five times or fewer.

That long tail is the story. Phishers keep building templates for lesser-known and regional targets, so "we're too small to be impersonated" isn't a plan. APWG also flags a quieter problem. Mail systems sometimes stop users forwarding phishing lures to APWG and similar organizations because the filters judge those messages harmful. Test your own report-phish path end to end, because a reporting button that quietly eats its own submissions is a blind spot you built yourself.

What Else You Need To Know

INTERPOL's Jackal IV went after the people who supply BEC crews
The eight-month operation against West African crime groups such as Black Axe spanned 22 countries, arrested 58 people and identified 263 suspects, and investigators also identified 196 people tied to a crime-as-a-service network that provided website domains and money laundering support to gangs behind romance, investment and business email compromise fraud.
A debt-relief callback campaign targeted more than 9,000 organizations
Check Point blocked about 24,700 emails over 14 days offering hardship programs and reduced payments, with no malicious links, attachments or malware, just a toll-free number and a promise of pre-approval, so the wording is the only thing left to judge.
Manchester Airports Group lost traveler booking data
Email addresses, phone numbers, vehicle registrations and postcodes tied to car park, lounge, Fast Track and Wi-Fi sign-ups at Manchester, Stansted and East Midlands were taken, UK outlets put the count at around 8.7 million customers (MAG hasn't confirmed a number), and customers are being told to watch for suspicious emails, texts and calls.
A phishing page that rewrites itself on every visit
SANS handler Jan Kopriva pulled 50 copies of a credential page linked from a phishing email and got 50 different SHA-256 hashes and 21 page titles, which leaves hash-based blocking little to match, though a buggy obfuscator left some copies stuck in an endless loop.

This roundup is published weekly by Red Sift. Test your email authentication set-up with Red Sift Investigate.

Subscribe here and stay up to date with what's happening in email security.