Sam's News — email-security — 2026-08-14¶

Security¶

7.5 New Passkey Attacks Bypass Phishing-Resistant MFA by Exploiting System Logs and Password Managers¶

Security researchers disclosed three separate attack vectors bypassing phishing-resistant FIDO2 multifactor authentication by exploiting Windows logs, password managers, and hardware key validation. Microsoft patched a critical vulnerability (CVE-2026-34348) in July 2026 updates; researchers warn of continuing risks from malware with system access.

Pass-the-Passkey research presented at Black Hat USA 2026 (August 5)
CVE-2026-34348 (CVSS 6.5): Windows Event Logging Service vulnerability patched July 2026
Unit 42 disclosed attacks against Google Password Manager recovering synced passkey private keys
Malware on signed-in Windows can use Windows Hello keys without PIN or biometric re-verification

Sources: The Hacker News AI Web Searched, thehackernews.com Web Search

7 Compromised Google Workspace accounts weaponized in mass phishing campaign¶

Attackers are using compromised Google Workspace accounts as a vector in large-scale phishing operations targeting organizations.

Sources: The420.in RSS

6 CTM360 Uncovers 3,000+ Recruitment Phishing URLs Using Browser-in-the-Browser Attacks¶

Security researchers discovered over 3,000 phishing URLs targeting job applicants using browser-in-the-browser credential harvesting techniques.

Sources: The Hacker News RSS

4.5 Jersey organizations hit by cyber attack; phishing threat warning issued¶

Several Jersey organizations have been affected by a cyber attack, prompting public warnings of increased phishing risk.

Sources: channeleye.media RSS

Email Security¶

7 Cisco Secure Email Threat Defense Achieves FedRAMP Class D (High) Certification¶

Cisco announced that its Secure Email Threat Defense has achieved FedRAMP Class D (High) certification, a landmark federal authorization for cloud security products. This certification signals that the solution meets rigorous U.S. government security standards and is approved for protecting sensitive government and regulated data.

Cisco Secure Email Threat Defense officially achieved FedRAMP Class D (High) certification on August 10, 2026
FedRAMP authorization requires stringent security controls, continuous monitoring, and independent third-party assessments
The solution uses AI-powered detections and can operate as an API-based supplemental control or inline gateway-level protection
Certification enables use with classified and controlled unclassified information (CUI) and mandates continuous authorization rather than one-time audit

Sources: Cisco Blogs AI Web Searched