Latest issue

What's happening in email security: October 5 - October 11, 2026

12 ottobre 2026

This week's attacks ran the full range of scale, from one employee's mailbox all the way up to three countries' domain registries. The mailbox belonged to a Nikkei employee, and it sent 9,000 phishing emails to colleagues and to the people Nikkei's journalists interview. The registries were hijacked long enough for attackers to get real certificates issued for Google names and, per Google, for several big global brands too. And a crew posing as Taiwanese research institutes sent invitations that read like an LLM wrote them.

Read the latest issue

Email Security Weekly issue #032 for October 5 - October 11, 2026. Key email security developments from Red Sift.

Archive

Past Email Security Weekly issues

32 issues

Email Security Weekly issue #032 for October 5 - October 11, 2026. Key email security developments from Red Sift.

12 ottobre 2026

What's happening in email security: October 5 - October 11, 2026

This week's attacks ran the full range of scale, from one employee's mailbox all the way up to three countries' domain registries. The mailbox belonged to a Nikkei employee, and it sent 9,000 phishing emails to colleagues and to the people Nikkei's journalists interview. The registries were hijacked long enough for attackers to get real certificates issued for Google names and, per Google, for several big global brands too. And a crew posing as Taiwanese research institutes sent invitations that read like an LLM wrote them.

Email Security Weekly issue #031 for September 28 - October 4, 2026. Key email security developments from Red Sift.

5 ottobre 2026

What's happening in email security: September 28 - October 4, 2026

DMARC had a strange week. In one story it passed mail it should have stopped, because Apple's own pipeline was signing forged iCloud senders. In another it correctly failed a spoof, and the message landed anyway because the impersonated domain sat at p=none. Around those two, FortiMail was exploited before Fortinet had fixed builds out for most versions, Star Blizzard kept mailing think tank invitations no think tank sent, and Microsoft says phishing's share of initial access more than tripled in a year.

Email Security Weekly issue #030 for September 21 - September 27, 2026. Key email security developments from Red Sift.

28 settembre 2026

What's happening in email security: September 21 - September 27, 2026

Resetting a password used to close the ticket. This week kept finding ways around that. Microsoft and its partners disrupted EvilTokens, the device-code service behind more than 12,000 compromised inboxes, and warned that its access can survive a reset. A Roundcube bug that needs no login and was patched in May is now reported as exploited, a GitLab email address pasted into a README turned out to be enough to push code to main for an account with the right role, and one phishing link showed how much effort now goes into simply not getting scanned.

Email Security Weekly issue #029 for September 14 - September 20, 2026. Key email security developments from Red Sift.

21 settembre 2026

What's happening in email security: September 14 - September 20, 2026

Most weeks the story is a message that should not have been trusted. This week it was the opposite. Revolut handed over customer data, reportedly including passports, to a request that authenticated perfectly, because the sending domain really did belong to a government agency. Meanwhile the appliance whose entire job is reading inbound mail turned out to hand over root to anyone who mailed it the right thing, an image-sharing service lost 23.62 million user records with email addresses among them, and a Pakistan-aligned crew staged its payloads on domains dressed as Indian newspapers.

Email Security Weekly issue #028 for September 7 - September 13, 2026. Key email security developments from Red Sift.

14 settembre 2026

What's happening in email security: September 7 - September 13, 2026

The most convincing phishing email of the week came from the real Trezor, through the real newsletter platform, to people who had signed up for it. A single sign-on bug at Brevo turned a marketing tool into a phishing cannon, help desk impersonators are using passkey enrollment as their excuse to call, Patch Tuesday fixed an Exchange flaw that a mailed Visio file can trigger, and Microsoft caught more than a million AI-assisted invoice emails borrowing both your CEO's name and ServiceNow's.

Email Security Weekly issue #027 for August 31 - September 6, 2026. Key email security developments from Red Sift.

7 settembre 2026

What's happening in email security: August 31 - September 6, 2026

What counts as proof took a beating this week. A loan-spam operation slipped invisible characters into its keywords and sent the mail through a reputable marketing platform. A new Microsoft 365 kit sent DocuSign lures that appeared to come from the recipient's own address, then planted a passwordless key that outlived the stolen session. Nearly 22,000 Exchange servers were still exposed to a bug that can hand over every mailbox, and a dark web shop claimed to be selling more than 153 million driver's license scans, which is bad news for any process that treats a photo of an ID as proof.

Email Security Weekly issue #026 for August 24 - August 30, 2026. Key email security developments from Red Sift.

31 agosto 2026

What's happening in email security: August 24 - August 30, 2026

Every check passed this week. The Docusign notification really came from Docusign, the caller really did know a name on the security team, and the phishing in one of CISA's latest red team assessments really came from an internal address. The defenses that held up were the ones looking past the sender, at the session, the device, and the app permissions behind the mailbox.

Email Security Weekly issue #025 for August 17 - August 23, 2026. Key email security developments from Red Sift.

24 agosto 2026

What's happening in email security: August 17 - August 23, 2026

It's back-to-school season, and attackers did their homework. Russian espionage crews spent the summer talking academics and defense staff into handing over app passwords and WhatsApp sessions, Check Point counted nearly 19,000 new education-themed domains in July alone, and the Justice Department put 17 names on a phishing operation that compromised about 8,000 professor mailboxes. Off campus, a Zimbra flaw let attackers run commands on mail servers using crafted SMTP requests, and two unrelated malware families decided the best place to ask for a password is a fake Windows lock screen.

Email Security Weekly issue #024 for August 10 - August 16, 2026. Key email security developments from Red Sift.

17 agosto 2026

What's happening in email security: August 10 - August 16, 2026

Reputation was the currency this week, and attackers kept spending other people's. A China-based group slipped one line of script into a government's shared webmail and let the real login page do the work. Lazarus ran its command channel through other people's Roundcube servers and phished from a company it had already breached. Researchers found three ways to bend passkeys without breaking them, and one buyer has spent nearly $7 million on expired domains for the reputation they still carry.

Email Security Weekly issue #023 for August 3 - August 9, 2026. Key email security developments from Red Sift.

10 agosto 2026

What's happening in email security: August 3 - August 9, 2026

Black Hat week usually produces one piece of research that quietly invalidates an assumption everyone was resting on. This year it was the idea that an email stays inside the reading pane. Alongside that, an adversary-in-the-middle campaign went hunting specifically through payroll and finance mailboxes, Kaspersky put numbers on how much phishing now runs from cloud platforms your allowlist trusts, and the IRS warned about a scam that arrives on paper.

Email Security Weekly issue #022 for July 27 - August 2, 2026. Key email security developments from Red Sift.

3 agosto 2026

What's happening in email security: July 27 - August 2, 2026

The best phishing this week didn't bother faking anything. Check Point watched attackers walk victims through Microsoft's genuine consent screen, Talos said phishing showed up in more than half of the incidents it worked last quarter, and law firms turned out to be a favorite stop for kits that proxy the login. Add an ad operation borrowing the faces of more than 400 brands, and IBM's finding that the priciest phishing arrives by phone and text.

Email Security Weekly issue #021 for July 20 - July 26, 2026. Key email security developments from Red Sift.

27 luglio 2026

What's happening in email security: July 20 - July 26, 2026

This was a week about email infrastructure, the servers and gateways and login pages that sit underneath the inbox. Russian operatives read three months of a target's mail without the victim clicking anything, police pulled the plug on a phishing platform that armed more than 1,800 criminal crews, and attackers turned hotel Wi-Fi into a way to steal Microsoft 365 logins from travelers. The lures matter, but so does everything the lure runs on.

Email Security Weekly issue #020 for July 13 - July 19, 2026. Key email security developments from Red Sift.

20 luglio 2026

What's happening in email security: July 13 – July 19, 2026

When a password manager has to warn its own users about a phishing campaign wearing its name, you know brand impersonation is the whole game. LastPass did exactly that this week. Microsoft shipped a record Patch Tuesday with yet another crafted-email Exchange flaw, two Scattered Spider members got real prison time, and a flaw in an AI browser assistant quietly opened a path to reading Gmail. Plenty to get through.

Email Security Weekly issue #019 for July 6 - July 12, 2026. Key email security developments from Red Sift.

13 luglio 2026

What's happening in email security: July 6 – July 12, 2026

The phishing email is increasingly just the opening move. This week's standout attack started with a survey email and ended with a fake IT-support call on Microsoft Teams. Elsewhere, scammers impersonated Robinhood with no links at all, and the device-code and encrypted-payload techniques we've been tracking kept mutating to stay ahead of the gateway. If your email defense stops at the inbox, several of these walk right past it.

Email Security Weekly issue #018 for June 29 - July 5, 2026. Key email security developments from Red Sift.

6 luglio 2026

What's happening in email security: June 29 – July 5, 2026

Last week the story was that phishing can pass your authentication checks. This week it's the sequel: once an attacker has a token, they don't need to phish you again. A ToddyCat tool quietly read corporate Gmail by riding an OAuth session, a Russia-linked crew phished Ukrainian targets with booby-trapped remote-desktop files, and a flaw in Apple's Hide My Email re-exposed the addresses it was built to hide. The through-line on the token story is persistence: modern email compromise is increasingly about holding access, not just getting in.

Email Security Weekly issue #017 for June 22 - June 28, 2026. Key email security developments from Red Sift.

29 giugno 2026

What's happening in email security: June 22 – June 28, 2026

Here's a sentence to ruin an email admin's afternoon: this week produced phishing that passed SPF, DKIM, and DMARC cleanly, plus a separate kit that sidesteps MFA without ever breaking it. Microsoft named the first technique "authentication laundering." The second, a device-code phishing platform, posted a 1,380% growth chart. Attackers also spent the week hiding lures inside Microsoft 365 Groups and calendar invites. If you've been treating an authentication pass or an MFA prompt as proof of trust, this is the week to stop.

Email Security Weekly issue #016 for June 15 - June 21, 2026. Key email security developments from Red Sift.

22 giugno 2026

What's happening in email security: June 15 – June 21, 2026

Two of this week's stories share an uncomfortable theme: the tools meant to help you handle email can be turned into ways to steal it. A Microsoft 365 Copilot flaw let a single click drain a mailbox, and a widely installed WordPress plugin leaked the credentials companies use to send mail. Add a billion-dollar phishing takedown and an Apple change that affects your allowlists, and it's a fuller week than the headline count suggests.

Email Security Weekly issue #015 for June 8 - June 14, 2026. Key email security developments from Red Sift.

15 giugno 2026

What's happening in email security: June 8 – June 14, 2026

Remember the Exchange zero-click we flagged in May, the one with no patch and a mitigation that broke calendar printing? It finally has a real fix. Microsoft shipped it as part of a 200-CVE Patch Tuesday that quietly cleaned up several more Exchange spoofing bugs, INTERPOL took 201 people off the board in a PhaaS sweep, and Google put a number on the fraud problem that's hard to unsee: roughly $580 billion lost worldwide last year.

Email Security Weekly issue #014 for June 1 - June 7, 2026. Key email security developments from Red Sift.

8 giugno 2026

What's happening in email security: June 1 – June 7, 2026

No breach dominated this week and no vendor shipped an emergency patch. What we got instead was a clear picture of where phishing actually is in mid-2026, and it's not the fake login page you're picturing. Attackers spent the week delivering JavaScript inside image files, skipping links entirely for phone numbers, and swapping credential-harvesting pages for malware that just takes the session cookie. The login prompt is optional now.

Email Security Weekly issue #013 for May 25 - May 31, 2026. Key email security developments from Red Sift.

1 giugno 2026

What's happening in email security: May 25 – May 31, 2026

Three things stood out this week. Scammers are already industrializing the 2026 World Cup with hundreds of fake FIFA sites, phishing found a new home inside AI assistants, and France drew a hard line on the tracking pixel that quietly sits in most marketing email. A busy end to the month, so let's get into it.

Email Security Weekly issue #012 for May 18 - May 24, 2026. Key email security developments from Red Sift.

25 maggio 2026

What's happening in email security: May 18 – May 24, 2026

The FBI doesn't issue a public warning about a phishing kit every week. This week it did, because Kali365 steals your Microsoft 365 access without ever touching your password or tripping MFA. Meanwhile a business professional in Singapore wired away S$4.9 million after a video call with people who were not real, and on-prem Exchange admins spent the week without a patch for an actively exploited flaw. The connecting thread: the login prompt is no longer where attacks are won or lost.

Email Security Weekly issue #011 for May 11 - May 17, 2026. Key email security developments from Red Sift.

18 maggio 2026

What's happening in email security: May 11 – May 17, 2026

DMARCbis is finally an RFC. Mail servers also had a rough week. Microsoft disclosed an actively exploited Exchange zero-click that fires when a user opens a crafted email in Outlook Web Access, Exim shipped a fix for a CVSS 9.8 remote code execution flaw triggered by a single TLS quirk, and a Belarus-aligned APT spent the spring running geofenced PDF phishing against Ukrainian government targets. If you run your own email infrastructure, you have patching and reading to do.

Email Security Weekly issue #010 for April 27 - May 3, 2026. Key email security developments from Red Sift.

4 maggio 2026

What's happening in email security: April 27-May 3, 2026

Two of this week's biggest phishing campaigns passed DMARC, SPF, and DKIM. Not because the authentication checks failed, but because the emails came from real senders. AppSheet shipped the attacker's lure for them. PayPal shipped it directly.

Email Security Weekly issue #009 for April 20 - April 26, 2026. Key email security developments from Red Sift.

27 aprile 2026

What's happening in email security: April 20 - April 26, 2026

Nobody needed a zero-day this week. UNC6692 buried a target's inbox in junk mail, then showed up on Microsoft Teams as the help desk offering to clean it up. Harvester ran its backdoor's command channel through a folder in an ordinary Outlook mailbox. A Chinese national is charged with spending five years posing as U.S. researchers to ask NASA staff and others for defense software, and NASA's watchdog says it sometimes worked. And Cisco Talos says phishing is back as the most common way in across its incident response cases.

Email Security Weekly issue #008 for April 13 - April 19, 2026. Key email security developments from Red Sift.

20 aprile 2026

What's happening in email security: April 13-19, 2026

Attackers don't need to keep logging in. Once they've cracked an M365 account, they're planting mailbox rules within seconds of first access, and those rules survive password resets. They keep quietly siphoning vendor threads long after the incident has been "closed."

Email Security Weekly issue #007 for April 6 - April 13, 2026. Key email security developments from Red Sift.

14 aprile 2026

What's happening in email security: April 6–13, 2026

Three separate threat actors ran adversary-in-the-middle campaigns in seven days. State actors, commercial PhaaS operators, and financially motivated criminals. AitM has graduated from sophisticated technique to standard issue. And this week, Microsoft documented what happens when you combine it with AI-generated lures at scale.

Email Security Weekly issue #006 for March 30 - April 5, 2026. Key email security developments from Red Sift.

6 aprile 2026

What's happening in email security: March 30 – April 5, 2026

Attackers don't need custom malware when legitimate software does the job. This week's most active campaign delivered trusted remote management tools to 80+ US organizations by hiding them inside fake party invitations. The emails looked like Punchbowl. The links went through HubSpot. The payload was LogMeIn. None of it would look wrong to most security tools.

Email Security Weekly issue #005 for March 23 - March 29, 2026. Key email security developments from Red Sift.

30 marzo 2026

What's happening in email security: March 23–29, 2026

Russia's FSB expanded their spear-phishing playbook to include an iOS exploit kit. In the same week, Iran-linked hackers compromised the FBI Director's personal email through a recycled password. Different actors, different targets, same gap: high-value individuals reached through channels that enterprise security doesn't cover.

Email Security Weekly issue #004 for March 16 - March 22, 2026. Key email security developments from Red Sift.

23 marzo 2026

What's happening in email security: March 16-22, 2026

Email authentication passed. The phishing still landed. That's the uncomfortable headline from this week. It's about attackers using Microsoft's own infrastructure to send phishing emails that pass every authentication check you have.

Email Security Weekly issue #003 for March 9 - March 15, 2026. Key email security developments from Red Sift.

16 marzo 2026

What's happening in email security: March 9-15, 2026

Attackers keep moving credential theft onto infrastructure defenders are reluctant to block. This week that meant a phishing kit built as a React app, hosted on Cloudflare Workers, and exfiltrating passwords through EmailJS. At the same time, the market data is clear on the defender side too: post-delivery cleanup, analyst workload, and identity-layer controls are now where email security programs win or lose.

Email Security Weekly issue #002 for March 2 - March 8, 2026. Key email security developments from Red Sift.

9 marzo 2026

What's happening in email security: March 2–8, 2026

Microsoft blocked more than 30 million Tycoon 2FA phishing emails in a single month. This week, law enforcement took the platform down. Competing AitM services are already filling the gap.

Email Security Weekly issue #001 for February 23 - March 21, 2026. Key email security developments from Red Sift.

3 marzo 2026

What's happening in email security: February 23 - March 1, 2026

APT28 spent five months beaconing victims through a developer tool nobody blocks. Meanwhile, the Sophos numbers confirm what most practitioners already sense: BEC is accelerating, and identity is still the primary attack surface.

Subscribe here and stay up to date with what's happening in email security.