Skip to content

Sam's News — email-security — 2026-09-20

Security

7.5 Phishing and BEC Attacks Exploiting Amazon SES

Attackers are exploiting Amazon SES's legitimate infrastructure to conduct phishing and business email compromise campaigns, bypassing email security measures through compromised accounts and misconfigured settings. Kaspersky research published in May 2026 documents specific examples of how the service enables fraudulent emails appearing to originate from trusted sources.

  • Kaspersky research published May 2026
  • Exploits compromised accounts and misconfigured SES settings
  • Attackers impersonate business communications for fraud

Sources: Kaspersky Securelist AI Web Searched, Securelist Web Search

7.5 AI Is Transforming Business Email Compromise Scams

Artificial intelligence is enabling more sophisticated variants of business email compromise attacks, an established fraud method.

  • AI linked to 55% of African cybercrimes
  • Cybercrime losses in Africa doubled to USD 484 million since 2024
  • 45% of public-sector tech leaders expect AI-enabled threats; only 28% feel prepared
  • Attackers creating synthetic identities by combining real and fabricated data

Sources: Forbes RSS Update to: AI-Enhanced Business Email Compromise Attacks Emerging

7 Ghost Phishing Wave Bypasses Traditional Email Security Defenses

The EvilTokens campaign uses AES-GCM encrypted HTML that hides malicious content from static URL checks, only decrypting after page load in the victim's browser. The attack targets businesses across the US and Europe using Microsoft Device Code Phishing to enable account takeover without stealing passwords directly.

  • AES-GCM encryption bypasses network-level inspection
  • Targets US and Europe: tech, manufacturing, education, banking, consulting, financial services, MSPs
  • Phishing exposure rates: 75.6% consulting, 72.8% financial services, 71.9% manufacturing, 67.9% technology, 66.7% banking, 66.1% MSPs
  • Microsoft Device Code Phishing enables M365 account takeover
  • Requires sandbox analysis with in-browser decryption for detection

Sources: The Hacker News AI Web Searched, thehackernews.com Web Search

7 NSA alerts Zimbra users to Russian state-sponsored phishing campaign

The NSA and 15 international partners warned of an active Russian state-sponsored phishing campaign targeting Zimbra Collaboration Suite users via the LAUNDRY BEAR group. The campaign exploits a zero-click vulnerability patched in November 2025 to steal email, credentials, and authentication tokens from defense, government, and NATO organizations.

  • Campaign conducted by LAUNDRY BEAR group since July 2025
  • Exploits zero-click vulnerability CVE-2025-66376 patched November 2025
  • Targets Ukrainian entities, U.S., and NATO organizations across defense, government, education, energy sectors
  • 16-country advisory includes NSA, FBI, CISA, and allied agencies

Sources: Potomac Officers Club AI Web Searched, National Cyber Security Centre (NCSC/GCHQ) AI Web Searched, The Record from Recorded Future AI Web Searched, National Security Agency (NSA) (.gov) Web Search

Legal frameworks and strategic defenses are evolving in response to business email compromise incidents.

Sources: Foley Hoag Web Search

4.5 Secure Email Threat Defense email security strength independently verified

Independent testing confirms the email security capabilities of a product called Secure Email Threat Defense.

Sources: Cisco Blogs Web Search