Email security

A malicious attachment could cause files to be written to sensitive locations, leading to RCE.

Cybernews reports that more than 6.8 billion unique email addresses were touted by threat actor Adkka72424 to have been included in a 150 GB database posted on BreachForums in early January.

The first known malicious Microsoft Outlook add-in has been discovered in the wild, marking a new frontier in supply chain attacks.

The phishing campaign, first detected in mid-December 2025, months before Pride Month, targets organizations globally, with the UK and United States being heavily impacted.

The root cause has been identified as a newly implemented URL rule designed to enhance the detection of sophisticated spam and phishing techniques.

CVE-2026-23760 and CVE-2026-24423 could both lead to RCE and are under active exploitation.

The spam campaign involves attackers exploiting Zendesk ticket submission forms to send emails to vast lists of addresses.

The campaign utilizes a wide range of randomly generated domains and subject lines designed to instill urgency, often personalizing messages with recipient names and specific dates.