Nikkei says a hacked Microsoft 365 account sent 9,000 phishing emails to staff and sources
Nikkei published two breach notices on Sunday 4 October, both in Japanese and both short. The second is the one that matters for anyone who runs a mail…
The Latest Updates
Security & Deliverability
Security & Deliverability
Nikkei says a hacked Microsoft 365 account sent 9,000 phishing emails to staff and sources
Nikkei published two breach notices on Sunday 4 October, both in Japanese and both short. The second is the one that matters for anyone who runs a mail…
Security & Deliverability
Nikkei published two breach notices on Sunday 4 October, both in Japanese and both short. The second is the one that matters for anyone who
Andrew Bonar
08/10/2026
Security & Deliverability
Postmastery has published the tenth edition of its Email Delivery Benchmark, covering April to June 2026. It is drawn from 15.5 billion transactions sent by
Emailexpert Editorial Team
25/09/2026
Security & Deliverability
Microsoft’s Digital Crimes Unit has disrupted EvilTokens, a phishing-as-a-service platform linked to more than 12,000 compromised inboxes at over 10,000 organisations since February. Working with
Emailexpert Editorial Team
25/09/2026
Security & Deliverability
Three pieces of research from the first fortnight of September describe different techniques with one move in common. Authentication stays intact in all three. Each
Emailexpert Editorial Team
18/09/2026
Security & Deliverability
Brevo has disclosed a security incident in which an attacker gained access to 138 customer accounts, using six of them to send phishing emails through
Emailexpert Editorial Team
18/09/2026
Security & Deliverability
Revolut disclosed sensitive information on around 680 customers after fraudsters submitted information requests through what turned out to be a certified Italian government email account,
Emailexpert Editorial Team
18/09/2026
Security & Deliverability
Check Point Research published findings on 8 September showing a hidden channel between ChatGPT accounts. An attacker’s session could hand a task to a stranger’s
Emailexpert Editorial Team
10/09/2026
Security & Deliverability
On 1 September the FBI’s Internet Crime Complaint Center published a public service announcement on OAuth consent phishing. Since late 2025, it says, attackers have
Emailexpert Editorial Team
10/09/2026
Security & Deliverability
Cloudflare has logged two email delivery incidents in under three weeks, one as a security gateway and one as a sender. In both, its advice
Emailexpert Editorial Team
10/09/2026
Security & Deliverability
Manchester Airports Group says the overwhelming majority of people affected by a major data breach had an email address exposed, while a smaller number had
Emailexpert Editorial Team
02/09/2026
Security & Deliverability
GMX and WEB.DE classified and filtered around 45% fewer spam messages during the first five months of 2026 than over the same period last year.
Emailexpert Editorial Team
26/08/2026
Security & Deliverability
Twilio SendGrid reported a significant increase in Microsoft 365 blocking last week, with block rates rising by 10 to 15 per cent across its sending
Emailexpert Editorial Team
19/08/2026
Security & Deliverability
TechCrunch has reported that Klaviyo inadvertently shared information entered by new customers during account registration, including passwords, with third-party advertising and tracking services. The report,
Emailexpert Editorial Team
19/08/2026
Security & Deliverability
Florence Bank, a Massachusetts community bank founded in 1873, has moved its domain to an enforced DMARC policy after a four-month engagement with EasyDMARC. The
Emailexpert Editorial Team
24/07/2026
Mailbox Providers
Gmail’s Deliverability analysis now issues a warning when spam rates exceed 0.1%. The soft target has become an active diagnosis. Here is what the two
Andrew Bonar
23/07/2026
Mailbox Providers
The Council of Anti-Phishing Japan links a June phishing surge to compromised ISP mailboxes and urges DMARC reject, BIMI, and passkeys, against the backdrop of
Emailexpert Editorial Team
23/07/2026
Mailbox Providers
Apple told 404 Media it patched the Hide My Email flaw on 3 July. AppleInsider reproduced the behaviour on 17 July, leaving the fix contested
Andrew Bonar
23/07/2026
Legal & Compliance
Pakistan’s PTA has triggered arrests over the illegal sale of telecom subscriber data, including call records, IMEI data, biometrics and location information.
Andrew Bonar
23/07/2026
Legal & Compliance
India’s securities regulator, the Securities and Exchange Board of India (SEBI), issued a formal caution to regulated entities and listed companies on 17 July 2026
Andrew Bonar
23/07/2026
Security & Deliverability
The latest phase of Operation Endgame has dismantled the infrastructure behind the Amadey loader and the StealC infostealer. Investigators took down 326 servers and 142
Emailexpert Editorial Team
02/07/2026
Security & Deliverability
In the week the New York Knicks won their first title in fifty-three years, the cybercrime group ShinyHunters breached their parent company, Madison Square Garden
Andrew Bonar
01/07/2026
Security & Deliverability
Microsoft has documented an active campaign against hotels that relays phishing through Calendly and Google so the mail authenticates cleanly. The lesson for the email
Andrew Bonar
01/07/2026
Security & Deliverability
Varonis turned Microsoft 365 Copilot into a one-click mailbox thief. The link was a real microsoft.com address, so your anti-phishing stack would have waved it
Andrew Bonar
18/06/2026
Security & Deliverability
The headline from EasyDMARC’s 2026 DMARC Adoption Report sounds like progress, and it is: 937,931 of the world’s top 1.8 million domains now publish a
Emailexpert Editorial Team
12/06/2026
Mailbox Providers
Microsoft says email-based phishing threats remained massive during the first quarter of 2026, with QR-code phishing and CAPTCHA-gated attacks emerging as some of the fastest-growing
Emailexpert Editorial Team
11/06/2026
Security & Deliverability
In February we wrote about a real Microsoft email being used for a scam, a genuine message, from genuine Microsoft infrastructure, doing a fraudster’s work
Andrew Bonar
11/06/2026
Security & Deliverability
Kaspersky researchers have documented a sharp rise in phishing campaigns sent through Amazon Simple Email Service, not by exploiting any flaw in SES, but by
Andrew Bonar
11/06/2026
Security & Deliverability
The FBI has issued a public service announcement (PSA 260521, 21 May) warning about Kali365, a phishing-as-a-service platform first spotted in April and sold mainly
Andrew Bonar
11/06/2026
Security & Deliverability
For the past couple of years, deliverability teams have been trading the same complaint: emails that pass SPF, DKIM and DMARC cleanly, sent from domains
Nely Bonar
25/05/2026
Security & Deliverability
35,000 users. 13,000 organisations. 26 countries. All hit in 48 hours. Microsoft Defender Research has uncovered a phishing campaign that targeted more than 35,000 users
Andrew Bonar
13/05/2026
Security & Deliverability
M3AAWG, the Messaging, Malware and Mobile Anti-Abuse Working Group, published an April 2026 update to its “TLS for Mail” baseline recommendations on its website, urging
Andrew Bonar
13/05/2026
Security & Deliverability
A recent phishing message targeting an emailexpert mailing list highlights a persistent problem in email security: authentication signals are frequently misunderstood. At first glance, the
Andrew Bonar
09/03/2026
Security & Deliverability
Days after researchers exposed abuse of Atlassian Jira Cloud to distribute investment scams from authenticated @atlassian.net addresses, a parallel campaign has emerged leveraging Xero’s email
Andrew Bonar
26/02/2026