What's happening in email security: June 22 – June 28, 2026

Microsoft warns of "authentication laundering" through Calendly

Since April, attackers have been phishing hotels across Europe and Asia by routing their messages through Calendly's real notification infrastructure. Because the mail genuinely originates from Calendly, it inherits Calendly's trusted authentication and passes SPF, DKIM, and DMARC on the way in. Microsoft calls this authentication laundering, and it's a precise name. The lures reference guest complaints, bedbug reports, and inspections, targeting front-desk and reservations staff, and they end in a ZIP with a disguised shortcut that installs a memory-only Node.js implant reported as TonRAT.

This is the clearest demonstration in a while of a thing email teams know intellectually but don't always defend against: SPF, DKIM, and DMARC authenticate the sending infrastructure, not the sender's intent or the message's content. A legitimate SaaS relay is a perfectly valid, fully authenticated way to deliver a malicious payload. The takeaway isn't that authentication is useless. It's that an authentication pass is the start of your inspection, not the end of it. You still have to look at the downstream links and behavior.

Attackers are hiding in Microsoft 365 Groups and your calendar

Fortra documented attackers abusing legitimate M365 collaboration features to make phishing look like routine business. They invite targets into attacker-controlled Groups themed around payroll, contracts, or training, then deliver lures through group mailboxes, shared files, and calendar invites. The "CalPhishing" variant drops recurring malicious events straight onto victims' calendars with .ics files, so the reminders keep the lure alive long after the original message would have been deleted. Because it all flows through genuine Microsoft infrastructure, external-sender warnings and early detection often don't fire.

Up to 14.2 million email logins exposed in a Japanese ISP breach

KDDI disclosed a breach of the shared email platform it runs for six ISPs, including JCOM, NIFTY, and BIGLOBE. Attackers exploited a flaw in third-party software, and only "some" passwords were hashed. Treat every affected address as exposed. A pool of ISP mail credentials that size is fuel for credential stuffing, account takeover, and the targeted phishing that follows.