Rebecca WarrenWhat's happening in email security: September 21 - September 27, 2026
Resetting a password used to close the ticket. This week kept finding ways around that. Microsoft and its partners disrupted EvilTokens, the device-code service behind more than 12,000 compromised inboxes, and warned that its access can survive a reset. A Roundcube bug that needs no login and was patched in May is now reported as exploited, a GitLab email address pasted into a README turned out to be enough to push code to main for an account with the right role, and one phishing link showed how much effort now goes into simply not getting scanned.
EvilTokens is disrupted, but the access it sold can outlive a password reset
On September 22 Microsoft announced that its Digital Crimes Unit and partners had disrupted EvilTokens, the phishing-as-a-service platform that turned device-code phishing into a subscription. Microsoft says it compromised more than 12,000 inboxes in over 10,000 organizations. The operators, tracked as Storm-2992, sold it over Telegram for $1,500 up front and $500 a month, and Coinbase traced roughly $1.1 million in platform revenue. A federal court in the Eastern District of Virginia authorized the action, Microsoft and its partners seized 50 websites and disabled more than 150 domains, and London's Metropolitan Police arrested two suspected site administrators, aged 32 and 38, earlier in September.
Look at what $500 a month bought. Once a victim entered the code on Microsoft's real login page, the platform used AI to comb the mailbox for wire-transfer details, pending invoices and executive correspondence, then helped write the BEC messages. That's a fraud analyst on retainer, not a phishing kit. And this isn't the end of the technique. BleepingComputer called it a disruption rather than a takedown and said the threat remains active, at least 10 platforms supported device-code phishing by April, and affiliates have already built clones such as APToken.
The work for you is eviction. Microsoft says access "could persist even after a password reset if the associated sessions and tokens were not also revoked," and some attackers registered a device for a Primary Refresh Token within 10 minutes of getting in. Pull every device-code sign-in your logs still hold, back to February if your retention reaches that far. For any you can't explain, revoke sessions, check for device registrations and inbox rules created around the same time, and consider briefly disabling the account, since existing access tokens can stay valid for up to an hour.
A Roundcube bug patched in May is now being exploited, no login required
On September 21 the Canadian Centre for Cyber Security updated its Roundcube advisory to say open-source reporting indicates CVE-2026-48842 is being exploited in the wild. It's a pre-authentication SQL injection in the bundled virtuser_query plugin, rated CVSS 8.1, and Roundcube fixed it in 1.6.16 and 1.7.1 on May 24. Nobody has said yet who is exploiting it.
Pre-auth is what moves this up your list. No phish, no stolen password. SentinelOne, quoted by The Hacker News, says the bug could expose mail account credentials and stored messages. Shadowserver counts more than 523,000 Roundcube instances exposed to the internet, though The Hacker News reports that only 10 of them had been flagged as vulnerable hosts as of September 23. Roundcube ships pre-installed with cPanel, so plenty of it runs on hosting accounts nobody thinks of as a mail server. CISA has flagged 11 Roundcube flaws as exploited since May 2022, and this is the second week running that the headline mail bug is a SQL injection, after Cisco's gateway flaw last issue.
Check whether virtuser_query is actually loaded in your config. If you don't use it, remove it, which is also the recommended stopgap if you can't upgrade right away. Don't stop at 1.6.16 either. The Canadian Centre's August advisory covers fixes through 1.6.18 and 1.7.3, so aim for the current release. Then hunt for the installs nobody owns, especially anything behind cPanel.
In GitLab, a leaked email address works like a password that skips 2FA
Aikido Security looked at GitLab's "email work item to this project" feature, the private address each user gets for filing issues by email. The string in the middle is a non-expiring token tied to the user's account, and GitLab doesn't check who sent the message. Swap the -issue suffix for -merge-request, add a branch name and a patch, and GitLab opens a merge request as you. If the patch edits .gitlab-ci.yml and your role allows it, the attacker's CI job runs too. In Aikido's test, GitLab blocked browser access and git clone from a non-allowlisted IP but still accepted the email, and the commit landed on main. Incoming email also works without 2FA, even where 2FA is required.
Aikido found about a dozen live addresses in public READMEs and support pages in one afternoon. GitLab closed the first report in May as intended behavior. After a second report in June it updated its documentation, and it now has an open issue to consider accepting these emails only from an address verified on the account owner.
In our view, that proposed fix deserves a closer look from anyone who runs mail. Plenty of tools turn inbound email into actions, from tickets to reply-by-email to mail-to-channel integrations, and many of them treat the recipient address as the authentication. Matching the From address only helps if the platform also checks that the message passed authentication for that domain, because a bare From header is the easiest thing in email to forge. On a domain that's still at p=none, a From check keyed on your employees' addresses isn't much of a gate. In the meantime, reset the incoming email token from GitLab's personal access tokens page and scrub posted addresses from your docs.
One phishing link, three ways to dodge the scanner, and a borrowed Croatian brand
Xavier Mertens at SANS ISC took apart one phishing link, hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/ followed by the recipient's own address. The random userinfo string before the @ is ignored by browsers but makes every URL unique, which blinds exact-match blocklists. The gynd-- label ends with hyphens, which shouldn't be valid, yet it still resolves, so strict link extractors may drop it unscanned. The recipient's address in the path pre-fills the kit and can fool parsers that split on the last @. As Mertens puts it, "A URL that is never extracted is never scanned."
The impersonation is the quiet part. koncar-hr[.]com borrows from Končar, the Croatian industrial group at koncar.hr, by turning the country-code suffix into a hyphen and adding .com. If your brand lives on a ccTLD, watch for that variant alongside the usual typos. Mertens' hunt comes down to three pattern checks. Flag URLs with more than one @, hostname labels that start or end with a hyphen, and paths containing the recipient's own email address.
In Gartner's survey, email incidents still outpace deepfakes
Gartner surveyed 297 senior security leaders between March and May for its AI-driven Social Engineering Attacks report, released September 22. Almost half reported at least one deepfake incident in the past year, 41% on an employee audio call and 36% on video. The number that's easy to miss is 79%, the share reporting at least one email phishing, spearphishing or BEC incident, well ahead of 58% for vishing or smishing.
Gartner's Craig Porter says the survey suggests phishing "is increasingly becoming an identity verification and trust problem." Fair, but email still led the survey's numbers. The most practical recommendation in the report is correlation. Tie impersonation reports and suspicious messages to account recovery events, new devices, privilege changes and financial transactions. Do that and a user's "this felt off" report stops being a closed ticket and becomes a lead.
- Microsoft is retiring SMS sign-in for Entra ID in February 2027
A Message Center reminder (MC1474104) tells admins to move users to phishing-resistant methods such as passkeys, which Microsoft said would start rolling out as the default sign-in experience in September, and the Entra SMS/Voice Policy Scanner script will show you who still depends on SMS or voice.
- TrustSink turns a rogue Entra MFA provider into a password logger
Varonis showed that an attacker with Global Administrator or Authentication Policy Administrator rights can register a fake external authentication method that captures passwords in plaintext mid-login, and since a reset doesn't remove it, the provider has to go before you rotate anything.
- A documentation placeholder domain is now serving ClickFix
Last issue it was a lapsed CDN domain, and this time Manifold Security found third-party[.]com, referenced in more than 1,700 repositories, serving a fake Cloudflare check that copies a PowerShell command, which is why documentation should stick to IANA-reserved names like example.com.
- LinkedIn lets verified companies remove fake employees
Admins of verified company Pages can remove people falsely claiming to work there from the company's people list, and LinkedIn is testing a setting that would require workplace verification, for example through a work email address.
Want email security news in your inbox every week?
Subscribe here and stay up to date with what's happening in email security.