DMARC360

Look at that sender again: "rnicrosoft". In lots of fonts, r and n side by side look just like m. Scammers buy lookalike domains like this, and since they own them, the email can still pass SPF, DKIM and DMARC. Read the address letter by letter before you click. #Phishing

A "FedEx tax invoice" PDF opens to a blank page, then your PDF reader asks to run something. Click no. Trellix found saying yes installs a backdoor that steals saved passwords and can watch your webcam. Real invoices don't run programs. thehackernews.com/2026/10/th… #Phishing

Invited to a private preview of Anthropic's new AI? Check the sender. Cofense found fakes sent through GoTo Webinar's real mailer, signed "Austin from nthropic", that still got past big email filters. The link leads to a fake Google or Microsoft login. darkreading.com/cyberattacks…

Your DMARC record says p=reject, so fakes get blocked? Check it for sp=none too. That tag covers your subdomains, real or made up, so fakes sent from them get no block request. Remove sp=none, or set it to reject once your real subdomains pass. rfc-editor.org/rfc/rfc9989.h…

Your inbox fills with hundreds of newsletter signups. Minutes later, "IT Support (Internal)" messages you on Teams offering to fix it. Arctic Wolf saw this in 400+ attacks. Look for the External tag, and don't let a chat stranger remote into your PC. darkreading.com/cloud-securi…

Set up DMARC but haven't seen a single report? Check your record for rua=. Without it, inbox providers are told not to send you the reports showing which servers send mail as your domain, fakes included. Add rua= with an inbox someone reads. rfc-editor.org/rfc/rfc9989.h…

Reset your hacked email password? The attacker may still be in. Huntress tracked attackers who broke into 97 Microsoft 365 accounts, then added their own devices and two-factor methods. A reset doesn't remove those. Sign out all sessions and delete them. thehackernews.com/2026/10/mi…

A "contract" email gives you a short code to type into Microsoft's real sign-in page. The page is real. The code is the scammer's, so typing it logs their device into your account, two-factor and all. Didn't ask for a code? Don't enter it. bleepingcomputer.com/news/se…

Applied for a building permit? Then an email quotes your real case number and asks you to wire a permit fee. The FBI says scammers lift those details from public permit records. Don't pay it. Call the office on the number from its official website. ic3.gov/PSA/2026/PSA260309

Hong Kong's health department says the email account behind its HIV testing site was misused to send fake warnings that people had been exposed to HIV. A real sender doesn't make a message true. Scary health news by email? Don't click. Call your clinic. info.gov.hk/gia/general/2026…

Set up DKIM years ago? DKIM is the hidden signature proving your email really came from you, and an old setup may still use a 1024-bit key. The DKIM rules say 2048-bit keys should be the norm. Ask your email provider to switch, then remove the old key. rfc-editor.org/rfc/rfc8301

Play Monster Hunter or Street Fighter online? Capcom says hackers took 11.7 million CAPCOM ID email addresses. Passwords and cards weren't hit, but that list is ready-made for phishing. If a "Capcom" email asks you to log in, open the site yourself. bleepingcomputer.com/news/se…

Bought a spare domain just so no one else grabs it? If it never sends email, scammers can still send mail posing as it. The UK's cyber agency (NCSC) says give it an SPF record of v=spf1 -all and a DMARC policy of p=reject. No upkeep after that. ncsc.gov.uk/blog-post/protec…

That fake parcel text may have come from a kit someone bought. Microsoft says a few phishing kits helped send 1 billion+ scam emails and texts since January, one with 2,300+ templates copying banks and couriers. Microsoft just seized their domains. blogs.microsoft.com/on-the-i…

Huntress caught attackers in hijacked Microsoft 365 mailboxes adding inbox rules with forgettable names like "s". One hid every email mentioning payroll, bank or bonus, so the owner never saw them. Open your inbox rules and delete any you didn't make. huntress.com/blog/token-repl…

Published a DMARC record, so nobody can fake your domain now? Check the p= part. At p=none you ask inboxes for nothing, so fakes just face their usual filters and plenty still land. Only p=quarantine (spam folder) or p=reject (block) asks them to act. rfc-editor.org/rfc/rfc9989.h…

A Dell email says you just bought $736 of software, with a "helpline" to call if it wasn't you. Cisco Talos found scammers slipping their numbers into real Dell and Staples order emails, so they passed DMARC. Don't call it. Check your account instead. blog.talosintelligence.com/p…

Your boss's name pops up asking you to grab some gift cards, quick. Tap the name and the real address is a random Gmail. DMARC can't block this one, since your company's domain was never used. Read the address, not the name, and check with your boss another way.

Roundcube, SquirrelMail and plenty of other webmail apps run on PHP. If your company hosts its own webmail, PHP2Shell puts the server holding everyone's inbox one request away from being taken over, no login needed. Patch first, then check your logs back to Oct 17.

One crafted email, no clicks needed, could run commands on some Zimbra mail servers. Microsoft saw attackers plant backdoors and copy mailbox data. Only servers with the optional SNMP monitoring add-on turned on are at risk. Patch to 10.1.20 or remove it. microsoft.com/en-us/security…