email security news
7 stories
Attackers conceal phishing lures using invisible Unicode characters
Threat actors have been observed employing an advanced phishing technique known as ASCII smuggling, which leverages invisible Unicode characters to bypass email security filters. This method, previously noted in AI prompt injection attacks, involves embedding Unicode characters from the Tags block (U+E0000 to U+E007F) to obscure malicious instructions or keywords.
Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
A large-scale phishing campaign has been identified that leverages invisible Unicode tag characters to bypass email security filters. The campaign, which has been active for several months and involved millions of emails, was reported by Microsoft. The primary goal of the attackers appears to be the distribution of phishing lures, often disguised as business loan or funding opportunities.
Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All
Two security researchers, working independently, have discovered that numerous organizations are inadvertently sending sensitive corporate and personal information to "no-reply" or "deleted user" email addresses. The researchers acquired several such domains and configured them to receive all incoming mail, revealing a widespread issue of system misconfigurations leading to data leakage.
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
New research has uncovered a sophisticated class of CSS-based attacks capable of circumventing webmail security mechanisms, allowing adversaries to exfiltrate sensitive data such as user passwords and session tokens. The reported techniques demonstrate a method for bypassing existing defenses in widely used email services, including those offered by Microsoft Outlook, Google Gmail, and Yahoo…
Attackers Use Text Salting to Evade AI-Powered Spam Filters
Cybersecurity firm Barracuda has reported a significant increase in phishing attacks employing "text salting," an older technique now being used to bypass AI-powered email filters. Since April, Barracuda has detected over one million retail-themed phishing attempts utilizing this method. While text salting has historically been effective against traditional secure email gateways, Barracuda…
Webinar tomorrow: Why modern email attacks require a new approach to defense
A webinar scheduled for July 8th will address the evolving landscape of email-based cyber threats and the limitations of current defense strategies. The event, titled "Stop chasing alerts: Automating email security with behavioral AI," will feature insights from Dan Nickolaisen, Solutions Architect Manager at Abnormal AI, and Eric Danneker, Director of Cyber Vigilance and Defense at Novant Health.
Cybercriminals Target Email Inboxes for Identity Theft
Email inboxes are increasingly targeted by cybercriminals due to their central role in digital identity and access, according to cybersecurity researchers. Attackers leverage compromised email accounts to gain broader access to other online services, facilitate financial fraud, and launch more sophisticated attacks.