email

Once Popular for Attacking AI, ASCII Smuggling Is Embraced by Spammers

, , ,

A Unicode block once used to stealthily embed malicious prompts in AI attacks—known as ASCII smuggling—is now being exploited by spammers to evade email filters. This block contains invisible characters that disrupt keyword detection by machine learning–based spam classifiers, allowing spammers to obfuscate trigger words without alerting human readers. Microsoft observed a sharp surge in such obfuscated spam emails in early 2026 and recommends updated filtering techniques to counter this evasion tactic.

https://arstechnica.com/security/2026/09/once-popular-for-attacking-ai-ascii-smuggling-is-embraced-by-spammers/

Hidden Prompts Trick AI Into False Email Summaries

, , ,

Researchers at Forcepoint X-Labs demonstrated that attackers can embed hidden HTML prompts in emails to manipulate AI-powered summarizers into producing false information without alerting users. Their proof-of-concept showed altered email summaries with incorrect financial and scheduling details, highlighting the risks of prompt injection attacks on AI systems that process untrusted external content. To mitigate these threats, organizations should separate trusted instructions from untrusted data, verify AI-generated outputs against source content, and enforce strict controls on AI assistant privileges.

https://www.darkreading.com/cyber-risk/hidden-prompts-trick-ai-false-email-summaries

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

, ,

New research presented by PortSwigger reveals novel CSS-based attacks that break webmail security boundaries to steal passwords, tokens, and hijack accounts across major providers like Outlook, Gmail, Yahoo Mail, and Proton Mail. These exploits abuse allowed HTML/CSS features or sanitizer discrepancies to escape email isolation, enabling phishing, token exfiltration, and UI manipulation, with some attacks still functional as of early August 2026. The study recommends sandboxing HTML emails and strict CSS restrictions to mitigate these evolving threats.

https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

, , ,

Russian cyber espionage group TA488 has exploited a cross-site scripting vulnerability (CVE-2026-42897) in Microsoft Outlook Web Access (OWA) to maintain persistent mailbox access even after credential changes. The implanted JavaScript malware, dubbed OWAReaper, operates stealthily within the OWA browser context, harvesting credentials, stealing OAuth tokens, and surviving device re-imaging by leveraging server-side persistence on Exchange servers and hidden offline cache elements. This advanced half-click exploit campaign targets various sectors including government and finance, enabling the actor to maintain long-term access that cannot be removed by credential rotation alone.

https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html

Attackers Are Turning Microsoft’s Trusted Login System Into Their Latest Phishing Weapon

, , ,

Attackers are exploiting Microsoft’s legitimate login system by directing victims to real Microsoft sign-in pages to grant permissions to malicious apps, enabling phishing campaigns to bypass traditional detection. This method, observed in over 200 phishing emails targeting around 120 organizations worldwide, allows attackers to access email, files, Teams, SharePoint, OneDrive, and calendars within the victim’s Microsoft 365 environment. The campaign emphasizes the growing threat of abuse of trusted authentication flows and highlights the need for vigilance despite appearances of legitimate Microsoft login prompts.

https://blog.checkpoint.com/email-security/attackers-are-turning-microsofts-trusted-login-system-into-their-latest-phishing-weapon/

1M+ Emails Use Hidden Text to Dupe AI Security Filters

, ,

Since April, over one million phishing emails have used hidden text techniques to evade AI-powered and traditional email security filters, according to Barracuda Networks researchers. Attackers manipulate email HTML by embedding invisible benign text alongside malicious content, confusing security gateways that primarily analyze machine-readable data rather than visual email presentation. Large language models (LLMs) accelerate attackers’ ability to generate and layer such obfuscation tactics, while current AI-based defenses struggle to detect the full malicious context behind these salted messages.

https://www.darkreading.com/threat-intelligence/1m-emails-hidden-text-dupe-ai-security-filters

New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

, , ,

Researchers have demonstrated a novel “MemGhost” attack that injects persistent false memories into AI personal assistants through a single crafted email, causing the AI to save deceptive information without alerting the user. Targeting assistants like OpenClaw that maintain memory files and access user inboxes, the attack stealthily alters the assistant’s knowledge base, influencing future interactions while evading detection by existing filters and user oversight. The study highlights a critical vulnerability where AI memory writes from untrusted inputs remain unregulated, urging the need for provenance tracking, user approval, and audit logging to mitigate such persistent memory poisoning risks.

https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html

New Ghost Phishing Wave Is Breaking Traditional Email Security

, ,

A new “ghost phishing” campaign called EvilTokens uses encrypted phishing pages that only decrypt and display malicious content within the victim's browser, bypassing traditional email and URL security checks. This technique primarily targets Microsoft 365 users across industries in the US and Europe, enabling account takeover without stealing passwords directly and complicating detection and response efforts. Security teams are urged to adopt browser-level sandboxing tools that reveal hidden phishing behaviors in real time to shorten exposure windows and improve incident containment.

https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html

New Gmail Account Attack Warning—Hackers Abuse Critical Security Check

, , ,

Hackers are targeting Gmail users with a malicious fake Google Account Security Checkup tool that grants attackers access to sensitive information, including push notifications, contacts, GPS location, and clipboard contents. This attack uses deception to trick users into following prompts that compromise their account security. To protect themselves, users should only use the official Google Account Security Checkup tool through official channels, such as typing the URL directly into their browser.

https://www.forbes.com/sites/daveywinder/2026/03/01/check-your-gmail-account-security-now-ongoing-attacks-reported/

Global SaaS Abuse Surge: U.S., Europe & APAC Targeted in Large‑Scale Phone‑Based Phishing

, ,

Phishing campaign using legitimate SaaS platforms saw 133,260 emails target over 20,000 organizations. Attackers exploited platform features to send authentic-looking scam emails, bypassing traditional detection methods. Techniques included manipulating user fields to create legitimate notifications from companies like Microsoft and Amazon, urging victims to call attacker-controlled phone numbers instead of clicking links. This trend reflects a strategic shift towards trust-based attacks, highlighting vulnerabilities in widely-used enterprise services and the need for improved detection strategies.

https://blog.checkpoint.com/research/saas-abuse-at-scale-phone-based-scam-campaign-leveraging-trusted-platforms/

Hackers Exploited Routing Scenarios and Misconfigurtions to Effectively Spoof Organizations

,

Hackers are exploiting complex email routing and misconfigurations to send deceptive phishing emails that appear to originate from within organizations. This technique has become prevalent since May 2025 and utilizes common tactics like fake voicemail alerts and document sharing to steal credentials. Organizations misconfigured in email routing are vulnerable, while those using Microsoft Exchange with Office 365 have built-in protections. Proper security configurations can mitigate risks associated with these attacks.

https://cybersecuritynews.com/hackers-exploited-routing-scenarios-and-misconfigurtions/

Phishing Campaign Abuses Google Cloud Services to Steal Microsoft 365 Logins

,

Phishing attacks exploit Google Cloud services to steal Microsoft 365 logins. Cybercriminals send fake Google emails, using trusted domains to redirect victims to a look-alike login page. Google acknowledges this abuse and has acted to mitigate such campaigns, advising users to verify URLs and use multi-factor authentication to enhance security.

https://www.malwarebytes.com/blog/news/2026/01/phishing-campaign-abuses-google-cloud-services-to-steal-microsoft-365-logins

Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign

, ,

Cybercriminals exploit Google Cloud's email integration to conduct a multi-stage phishing campaign, sending 9,394 emails to over 3,200 targets globally. Using trusted Google-generated messages, attackers bypass security filters and mimic legitimate notifications to steal user credentials through deceptive links leading to fake verification and login pages. Google has responded by blocking these phishing attempts and enhancing protections.

https://thehackernews.com/2026/01/cybercriminals-abuse-google-cloud-email.html

Beware: PayPal Subscriptions Abused to Send Fake Purchase Emails

,

PayPal subscriptions are being exploited in a scam where fake purchase emails are sent, misleading people into believing they made expensive transactions. The emails, appearing legitimate, originate from “[email protected]” and include modified customer service URLs displaying fake purchase notifications. Scammers intend to instill fear, prompting recipients to call a fake PayPal support number. Although legit email formats are used, PayPal is working to mitigate this scam. Recipients are advised to ignore such emails and verify their account directly through PayPal.

https://www.bleepingcomputer.com/news/security/beware-paypal-subscriptions-abused-to-send-fake-purchase-emails/

Email Security: Where We Are and What the Future Holds

,

Email security is flawed, relying on outdated protocols like SMTP, which lacks encryption by default. Various solutions like STARTTLS, SMTPS, and end-to-end encryption via PGP and S/MIME attempt to improve security but face usability and trust issues. Authentication mechanisms (SPF, DKIM, DMARC) help but are vulnerable due to DNS weaknesses. The future calls for enhanced E2EE, adoption of DNSSEC, and overall improvements in protocols to strengthen email as a secure communication tool, moving away from its role in account recovery and toward focused communication purposes.

https://www.privacyguides.org/posts/2025/11/15/email-security-where-we-are-and-what-the-future-holds/

Scroll to Top