Researchers at Microsoft are tracking a social engineering campaign that uses passkey-themed lures to trick users into granting persistent access to their accounts and online work environments.
Threat actors are using phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters, according to researchers at ReliaQuest.
Microsoft 365 Exchange Online uses a feature called βRejectDirectSendβ to block unauthenticated Direct Send emails from an organizationβs trusted domain. If an attacker omits the domain field from these emails, however, RejectDirectSend will no longer block the messages. Attackers can therefore exploit this technique to impersonate internal users.
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal
Google Workspace powers more thanΒ 3 billion active users globally. From agile mid-market firms to global enterprise operations, Gmail and Google Workspace serve as the digital backbone for millions of teams.
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
Researchers at Microsoft warn that phishing emails are still the top initial access vector, with more than 2 billion phishing threats detected each month during the second quarter of 2026.
By Shikhar Dalela and Jeewan Singh Jalal
The operators named the kit themselves.
Buried inside compromised legitimate websites, the hidden staging directory is sometimes literally called β/.bulletproofβ, and the PHP session cookie the kit sets on every visitor is named βbp_redir_sess.β The βbpβ stands for bulletproof, which is an unusual degree of candor from a threat actor whose entire design philosophy is concealment.
Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal
Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.
When it comes to outbound email security, every organization operates under different operational constraints and security requirements. Some security teams prioritize in-app nudges and coaching to catch risky behavior the moment an email is drafted. Others want to avoid friction, particularly for executives, sales teamsΒ or mobile-first employees who rarely interact with desktop add-ins.
Security operations teams face a constant balancing act: stopping sophisticated email threats, maintaining visibility across their attack surface and keeping administrative workflows running smoothly. When security tools operate in silos or rely on rigid, manual processes, friction builds up quickly. This friction consumes valuable time that analysts could spend on higher-priority initiatives.
Picture this: Your company just fell victim to a massive data breach. The culprit wasn't a sophisticated malware strain, a zero-day exploit, or a compromised firewall. It was a perfectly legitimate-looking login from a VPβs account, originating from an unrecognized IP address, requesting an urgent wire transfer via a spotless, text-only email.
When we think about email security, our minds almost always jump to the inbound threats: the sophisticated phishing lures, the AI-generated business email compromise (BEC) attacks, and the malicious attachments knocking at the perimeter.
Cloud email has become the center of modern business. Regardless of your organization's industry or size, email connects employees, customers, vendors, executives, financial systemsΒ and critical business processes.
Login