Collecting Cyber-News from over 60 sources

Tag: email

Microsoft 365 Copilot Bug Circumvented DLP Controls

Feb 20, 2026 6:01 PM

Tags: ai, control, email, governance, microsoft

Microsoft confirmed a Copilot Chat bug that summarized confidential emails despite active DLP controls, raising AI governance concerns in Microsoft 365. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/microsoft-365-copilot-bug-circumvented-dlp-controls/
DMARC Providers in 2026: Top DMARC Services and Enterprise Solutions

Feb 20, 2026 5:02 PM

Tags: dmarc, email, service

Originally published at DMARC Providers in 2026: Top DMARC Services and Enterprise Solutions by EasyDMARC. Email security requirements are getting stricter every year. … First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/dmarc-providers-in-2026-top-dmarc-services-and-enterprise-solutions/
DMARC Providers in 2026: Top DMARC Services and Enterprise Solutions

Feb 20, 2026 5:02 PM

Tags: dmarc, email, service

Originally published at DMARC Providers in 2026: Top DMARC Services and Enterprise Solutions by EasyDMARC. Email security requirements are getting stricter every year. … First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/dmarc-providers-in-2026-top-dmarc-services-and-enterprise-solutions/
Ready to Move On: How to Evaluate, Select, and Deploy Modern Email Security

Feb 20, 2026 3:01 PM

Tags: email, guide

<div cla Part 4 of a 4-Part Series: The SEG Breakup Guide for MSPs First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/ready-to-move-on-how-to-evaluate-select-and-deploy-modern-email-security/
Hackers breach contractor linked to Ukraine’s central bank collectible coin store

Feb 20, 2026 2:01 PM

Tags: access, breach, data, email, finance, hacker, phone, ukraine

The National Bank of Ukraine announced that attackers may have gained access to users’ personal data, including names, phone numbers, email addresses and delivery addresses, in a recent cyberattack. First seen on therecord.media Jump to article: therecord.media/hackers-breach-ukraine-national-bank-contractor
PayPal launches latest struggle to get rid of SMS for MFA

Feb 20, 2026 9:01 AM

Tags: authentication, ceo, ciso, communications, compliance, cybersecurity, email, finance, fraud, government, group, login, mfa, mobile, nfc, passkey, password, phishing, risk, service, strategy, switch, update

Muddled effort, mixed messages Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, says he’s “always found it odd” that PayPal still supports SMS as its primary secondary authentication factor.”Everyone in financial services and government has abandoned it for not being sufficiently secure and are moving to even phishing-resistant authentication, such as passkeys, Yubikeys,” he…
New phishing campaign tricks employees into bypassing Microsoft 365 MFA

Feb 20, 2026 5:01 AM

Tags: access, attack, awareness, business, credentials, defense, email, google, identity, incident response, least-privilege, login, malicious, mfa, microsoft, monitoring, office, phishing, risk, saas, social-engineering, training

microsoft.com. But the attacker has pre-registered their device to get the code for [the victim] to verify.”David Shipley, head of Canadian security awareness training provider Beauceron Security, said OAuth device code attacks have been gaining steam since 2024. “It’s the natural evolutionary response to improvements in account security, particularly MFA”, he said. The easiest defense is…
Your Most Dangerous User Is Not Human: How AI Agents and MCP Servers Broke the Internal API Walled Garden

Feb 20, 2026 1:01 AM

Tags: access, ai, api, attack, business, ciso, data, defense, email, exploit, governance, guide, hacker, malicious, microsoft, network, office, risk, threat, tool, vulnerability, waf

Highlights The Perimeter is Porous: Modern Agentic AI and the Model Context Protocol (MCP) have effectively turned internal data centers inside out, making the “internal API” security model obsolete. The “Confused Deputy” Risk: Legitimate AI agents act as trusted internal entities but can be exploited to bypass Data Loss Prevention (DLP) policies, as seen in…
Figure Data Breach Exposes Nearly 1 Million Customers Online

Feb 19, 2026 7:01 PM

Tags: breach, data, data-breach, email, fintech, social-engineering

Fintech lender Figure suffered a social-engineering breach that led to a data dump online. Have I Been Pwned found 967,200 exposed email records. The post Figure Data Breach Exposes Nearly 1 Million Customers Online appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-figure-data-breach-967200-email-records/
DEF CON bans three Epstein-linked men from future events

Feb 19, 2026 3:01 PM

Tags: email

Emails show all discussed networking and biz interests with the sex offender throughout the 2010s First seen on theregister.com Jump to article: www.theregister.com/2026/02/19/def_con_epstein_bans/
CISA alerts to critical auth bypass CVE-2026-1670 in Honeywell CCTVs

Feb 19, 2026 2:01 PM

Tags: access, authentication, cctv, cisa, cve, cybersecurity, email, flaw, infrastructure, unauthorized

CISA warns Honeywell CCTVs are affected by a critical auth bypass flaw (CVE-2026-1670) allowing unauthorized access or account hijacking. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that Honeywell CCTVs are affected by a critical authentication bypass flaw, tracked as CVE-2026-1670 (CVSS score of 9.8), that lets attackers change the recovery email without logging…
CISA alerts to critical auth bypass CVE-2026-1670 in Honeywell CCTVs

Feb 19, 2026 2:01 PM

Tags: access, authentication, cctv, cisa, cve, cybersecurity, email, flaw, infrastructure, unauthorized

CISA warns Honeywell CCTVs are affected by a critical auth bypass flaw (CVE-2026-1670) allowing unauthorized access or account hijacking. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that Honeywell CCTVs are affected by a critical authentication bypass flaw, tracked as CVE-2026-1670 (CVSS score of 9.8), that lets attackers change the recovery email without logging…
SPF Alignment: Why is it Important for Improving DMARC

Feb 19, 2026 1:01 PM

Tags: dmarc, email

Originally published at SPF Alignment: Why is it Important for Improving DMARC by EasyDMARC. Every day, inboxes receive millions of emails that … First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/spf-alignment-why-is-it-important-for-improving-dmarc/
Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via DNS

Feb 19, 2026 10:01 AM

Tags: cyber, dns, email, hacker, malicious, malware, phishing, social-engineering, tool

Social engineering campaigns are becoming increasingly sophisticated, moving beyond simple phishing emails to more complex technical deceptions. The >>ClickFix<>fix<< a fake browser error, has undergone significant evolution. Security researcher Muhammad Hassoub has observed attackers moving away from high-noise tools that trigger immediate […] The post Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via…
Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via DNS

Feb 19, 2026 10:01 AM

Tags: cyber, dns, email, hacker, malicious, malware, phishing, social-engineering, tool

Social engineering campaigns are becoming increasingly sophisticated, moving beyond simple phishing emails to more complex technical deceptions. The >>ClickFix<>fix<< a fake browser error, has undergone significant evolution. Security researcher Muhammad Hassoub has observed attackers moving away from high-noise tools that trigger immediate […] The post Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via…
Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via DNS

Feb 19, 2026 10:01 AM

Tags: cyber, dns, email, hacker, malicious, malware, phishing, social-engineering, tool

Social engineering campaigns are becoming increasingly sophisticated, moving beyond simple phishing emails to more complex technical deceptions. The >>ClickFix<>fix<< a fake browser error, has undergone significant evolution. Security researcher Muhammad Hassoub has observed attackers moving away from high-noise tools that trigger immediate […] The post Hackers Abuse nslookup.exe in ClickFix Campaign to Deliver Malware via…
Microsoft 365 Copilot Vulnerability Exposes Sensitive Emails Through AI Summaries

Feb 19, 2026 7:01 AM

Tags: ai, cyber, data, email, flaw, microsoft, unauthorized, vulnerability

A security flaw in Microsoft 365 Copilot is currently causing the AI assistant to incorrectly summarize email messages protected by confidentiality sensitivity labels, essentially bypassing configured Data Loss Prevention (DLP) policies. This vulnerability exposes potentially sensitive organizational data to unauthorized AI processing. The issue, tracked under Microsoft reference CW1226324, was first flagged on February 4,…
OWASP Agentic Top 10: Agent Goal Hijack FireTail Blog

Feb 19, 2026 1:01 AM

Tags: ai, attack, control, data, email, finance, LLM, malicious, microsoft, risk, strategy, tool, unauthorized, zero-trust

Feb 18, 2026 – Lina Romero – What is Agent Goal Hijack?Agent Goal Hijack occurs when an attacker manipulates an agent’s objectives or decision pathways. Unlike traditional LLM attacks that focus on altering a single response, ASI01 targets the planning logic of the agent.Agents rely on natural-language instructions, so they often can’t reliably distinguish between…
Microsoft Patches Security Flaw That Exposed Confidential Emails to AI

Feb 18, 2026 10:01 PM

Tags: ai, corporate, data, data-breach, email, flaw, microsoft, privacy

Microsoft Corp. confirmed it is addressing a significant security lapse that allowed its Copilot AI to bypass privacy protections and summarize users’ confidential emails without authorization. The bug, which has persisted since late January, effectively ignored data loss prevention (DLP) protocols designed to keep sensitive corporate information out of the reach of large language models..…
Microsoft Patches Security Flaw That Exposed Confidential Emails to AI

Feb 18, 2026 10:01 PM

Tags: ai, corporate, data, data-breach, email, flaw, microsoft, privacy

Microsoft Corp. confirmed it is addressing a significant security lapse that allowed its Copilot AI to bypass privacy protections and summarize users’ confidential emails without authorization. The bug, which has persisted since late January, effectively ignored data loss prevention (DLP) protocols designed to keep sensitive corporate information out of the reach of large language models..…
Data breach at fintech giant Figure affects close to a million customers

Feb 18, 2026 7:58 PM

Tags: breach, data, data-breach, email, fintech, hacker, phone

The Figure data breach allowed hackers to steal customer names, dates of birth, physical addresses, phone numbers, and email addresses. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/18/data-breach-at-fintech-giant-figure-affects-close-to-a-million-customers/
Substack Breach May Have Leaked Nearly 700,000 User Details Online

Feb 18, 2026 7:58 PM

Tags: breach, data-breach, email, hacker, phone

Substack says hackers accessed user emails, phone numbers, and internal metadata in October 2025, with a database of 697,313 records later posted online. The post Substack Breach May Have Leaked Nearly 700,000 User Details Online appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-substack-data-breach-user-accounts-leaked/
Hackers Increasingly Prefer Fast and Low-Complexity Attacks

Feb 18, 2026 6:58 PM

Tags: access, attack, business, email, exploit, hacker, hacking, ransomware, threat

Incident Responders Detail Top Ransomware and Business Email Compromise Tactics. There’s no need to invest into sophisticated hacking operations when moving fast and exploiting well-trod techniques gives threat actors all the access they want. Threat actors are prioritizing low-complexity entry points, rather than investing in sophisticated exploits, say incident responders. First seen on govinfosecurity.com Jump…
The 20 Coolest Web, Email and Application Security Companies Of 2026: The Security 100

Feb 18, 2026 6:58 PM

Tags: ai, application-security, email

CRN’s Security 100 list of the coolest web, email and application security companies includes AI-powered vendors protecting email inboxes and web browsers along with providers of modern code security. First seen on crn.com Jump to article: www.crn.com/news/security/2026/the-20-coolest-web-email-and-application-security-companies-of-2026-the-security-100
Anti-phishing rules mistakenly blocked emails, Teams messages

Feb 18, 2026 5:58 PM

Tags: credentials, detection, email, microsoft, phishing

Microsoft says an Exchange Online issue that mistakenly quarantined legitimate emails last week was triggered by faulty heuristic detection rules designed to block credential phishing campaigns. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-anti-phishing-rules-mistakenly-blocked-emails-teams-messages/
Microsoft says Office bug exposed customers’ confidential emails to Copilot AI

Feb 18, 2026 4:58 PM

Tags: ai, data, data-breach, email, microsoft, office

Microsoft said the bug meant that its Copilot AI chatbot was reading and summarizing paying customers’ confidential emails, bypassing data protection policies. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/
Carelessness versus craftsmanship in cryptography

Feb 18, 2026 3:58 PM

Tags: access, advisory, api, attack, authentication, computing, credentials, cryptography, data, email, encryption, github, hacker, oracle, side-channel, software, threat, tool, update, vpn, vulnerability

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects. When we shared one of these bugs with an affected vendor, strongSwan, the maintainer provided a model response for security vendors. The…
Carelessness versus craftsmanship in cryptography

Feb 18, 2026 3:58 PM

Tags: access, advisory, api, attack, authentication, computing, credentials, cryptography, data, email, encryption, github, hacker, oracle, side-channel, software, threat, tool, update, vpn, vulnerability

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects. When we shared one of these bugs with an affected vendor, strongSwan, the maintainer provided a model response for security vendors. The…
Scammers exploit trust in Atlassian Jira to target organizations

Feb 18, 2026 2:58 PM

Tags: email, exploit, scam, threat

Threat actors have leveraged legitimate email notification feature of Atlassian Jira to deliver localized scam emails at scale. The emails From late December 2025 through late … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/atlassian-jira-scam-emails/
Microsoft says bug causes Copilot to summarize confidential emails

Feb 18, 2026 1:58 PM

Tags: ai, data, email, microsoft

Microsoft says a Microsoft 365 Copilot bug has been causing the AI assistant to summarize confidential emails since late January, bypassing data loss prevention (DLP) policies that organizations rely on to protect sensitive information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails/