Email Security

Detection engineering logic that correlates Elastic Defend endpoint alerts with network security events from PAN-OS, FortiGate, and Suricata to identify potentially compromised hosts based on multi-source telemetry.

Attackers are repurposing the ASCII smuggling technique, originally intended for AI prompt injection, to embed invisible Unicode tag characters into phishing emails to bypass keyword-based security filters.

The parsedmarc library before version 11.0.1 is vulnerable to remote denial-of-service exploitation via crafted email attachments that trigger memory exhaustion through unbounded decompression.

SEPPmail Secure E-Mail Gateway contains multiple vulnerabilities that an attacker can exploit to bypass security controls and achieve remote code execution on the appliance.

The Sophos State of Ransomware 2026 report indicates that while median ransom payments are dropping, successful data encryption by ransomware attackers is climbing, with malicious email, phishing, and compromised credentials now surpassing exploited vulnerabilities as the primary initial access vectors, often leveraging identity-based attacks against critical systems like VPNs and firewalls.

A threat actor group is actively conducting a phishing campaign since November 2025, abusing Meta's legitimate Business Account Manager service to send emails from noreply@business.facebook.com containing malicious Google Sites URLs that redirect to sophisticated phishing pages, ultimately aiming to steal Meta account credentials, MFA codes, personal and business contact information, and identification documents from targeted businesses, with recent evolutions including a Facebook Messenger chatbot and exfiltration to Telegram.

A remote, authenticated attacker with administrator rights can exploit multiple vulnerabilities in SonicWall Email Security Appliance to perform cross-site scripting, manipulate data, or cause a denial-of-service.

A user created a self-hosted email threat detection tool, named VerdictMail, employing IMAP IDLE for real-time monitoring and multi-stage enrichment via SPF, DKIM, DMARC, DNSBL, WHOIS, URLhaus, and VirusTotal, coupled with an LLM for threat assessment.