#email-security

Researchers revealed how malicious Outlook add-ins can quietly siphon email data without triggering audit logs, evading standard Microsoft 365 monitoring.

Source: Varonis Threat Labs

Cybercriminals are now chaining up to six layers of URL rewrites from vendors including Cisco, Sophos, and Barracuda to make phishing links appear to originate from trusted security platforms — and it's working well enough to steal credentials and session tokens at scale.

Source: LevelBlue

Microsoft patched CVE-2026-40361, a use-after-free vulnerability in Word and Outlook that enables remote code execution when specially crafted emails are previewed in the Outlook pane. The flaw affects Microsoft 365 Apps, Office 2019, Office LTSC and Word 2016, with attackers able to trigger exploitation without user interaction in Exchange environments.

Source: Microsoft | SecurityWeek

Attackers are abusing complex email routing and spoofing gaps to send phishing emails that appear to come from inside the victim’s own organisation.

Source: Microsoft Threat Intelligence

Phishers are hiding phone scam messages inside signed, legitimate-looking emails that slip past security checks and trick recipients into calling attackers.

Source: Cofense

A newly patched SmarterMail bug was weaponised almost instantly, letting attackers seize admin accounts and execute code on exposed email servers.

Source: Huntress

Phishing emails posing as employee performance reports are tricking victims into launching malware that opens the door to remote spying and data theft.

Source: AhnLab Security Intelligence Center