Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Threat actors are actively exploiting Microsoft 365's Direct Send feature to deliver phishing emails, bypassing perimeter security solutions by routing malicious messages through trusted infrastructure. This technique requires no credentials, only knowledge of the target domain and valid recipient addresses. The attack process involves identifying organizational domains, crafting emails impersonating internal users, and delivering them through Microsoft 365's infrastructure. Recent campaigns have successfully harvested credentials and established footholds within targeted environments. Attackers use automated tools to generate convincing business-themed lures, often utilizing PDF and DOCX attachments with QR codes or obfuscated HTML leading to phishing pages. The abuse of Direct Send represents a critical gap in email security defenses, particularly for organizations relying heavily on email communications.

The threat involves malicious actors exploiting the Microsoft 365 Direct Send feature to conduct phishing campaigns that bypass traditional perimeter email security controls. Direct Send is designed to allow organizations to send emails from internal devices or applications directly through Microsoft 365 infrastructure without requiring SMTP authentication credentials. Attackers leverage this by identifying target organizational domains and valid recipient email addresses, enabling them to craft emails that appear to originate from internal users or trusted sources within the organization. This technique does not require stolen credentials, only knowledge of the target domain and recipient addresses, making it accessible to a wide range of threat actors.

The attack process typically involves reconnaissance to identify organizational domains and valid email addresses, followed by the creation of convincing phishing emails that often include business-themed lures. These emails frequently contain PDF or DOCX attachments embedded with QR codes or obfuscated HTML that redirect victims to phishing websites designed to harvest credentials or deliver malware. Because the emails are routed through Microsoft 365's trusted infrastructure, they can evade many traditional email security solutions that rely on external reputation or sender verification checks.

Recent campaigns exploiting this technique have successfully harvested credentials and established footholds within targeted environments, facilitating further compromise such as business email compromise (BEC) and lateral movement. The abuse of Direct Send represents a critical gap in email security defenses, especially for organizations heavily reliant on Microsoft 365 for email communications. The threat is compounded by the use of automated tools to generate highly convincing phishing content, increasing the likelihood of victim interaction and successful exploitation.

Detailed information about Microsoft 365 Direct Send Abuse: Phishing Risks & Security Recommendations. Get real-time updates, technical details, and mitigation 

Microsoft 365 Direct Send Abuse: Phishing Risks & Security Recommendations - Live Threat Intelligence - Threat Radar | OffSeq.com

Microsoft 365 Direct Send Abuse: Phishing Risks & Security Recommendations

Homograph attacks involve using non-Latin characters that visually resemble Latin characters to create words that appear legitimate but are actually different. This technique allows attackers to evade detection and analysis, crafting malicious emails that can lead to credential theft or malware infection. The article examines three real-world cases of homograph attacks used in phishing attempts, including impersonation of well-known brands and document-sharing platforms. These attacks exploit visual similarities to deceive users, bypass security filters, and impersonate trusted entities. The rise of AI-driven phishing makes this vector even more dangerous. To protect against homograph attacks, it's crucial to carefully examine sender addresses, be wary of unknown senders, and avoid engaging with suspicious attachments or URLs.

The threat described is a homograph attack campaign that leverages the visual similarity between non-Latin Unicode characters and Latin characters to craft deceptive domain names and email addresses. Attackers exploit these homographs to create malicious emails that appear to originate from legitimate and trusted sources, such as well-known brands or document-sharing platforms. These emails are designed to bypass traditional security filters and deceive users into clicking on malicious links or opening harmful attachments. The campaign includes real-world cases where homograph domains impersonate legitimate entities, facilitating phishing attacks aimed at credential theft or malware infection. The rise of AI-driven phishing techniques exacerbates the threat by enabling more convincing and targeted social engineering attacks. Indicators include multiple suspicious domains, some with European country code top-level domains (e.g., .fr) or domains that could target European users. The attack technique falls under social engineering tactics (MITRE ATT&CK techniques T1566 and T1204 variants), emphasizing user deception rather than exploiting software vulnerabilities. Because homograph attacks rely on visual deception rather than technical exploits, they are difficult to detect automatically and require heightened user awareness and advanced email filtering capabilities.

Detailed information about The Homograph Illusion: Not Everything Is As It Seems. Get real-time updates, technical details, and mitigation strategies.

The Homograph Illusion: Not Everything Is As It Seems - Live Threat Intelligence - Threat Radar | OffSeq.com

The Homograph Illusion: Not Everything Is As It Seems

A new phishing campaign has been observed leveraging a .gov domain to deceive employees into believing they owe an unpaid toll. The scam uses urgency and fear tactics, threatening penalties or vehicle registration holds if the balance is not paid immediately. The threat actors utilize the GovDelivery system to increase legitimacy, despite using Indiana's instance for a Texas-related scam. The phishing link leads to a fake website that collects personal information and credit card details. The campaign exploits fear of consequences and mimics a well-known service, highlighting the importance of integrating human expertise into email security processes to identify threats that bypass conventional malicious indicators.

The TxTag Takedown phishing campaign is a sophisticated social engineering attack that exploits the inherent trust in official government communication channels to deceive recipients into believing they owe unpaid toll fees. The attackers leverage a legitimate .gov domain and the GovDelivery communication platform—specifically Indiana's GovDelivery instance—to lend credibility to fraudulent emails purporting to be related to Texas toll violations. These emails employ urgency and fear tactics, warning recipients of penalties or vehicle registration holds if immediate payment is not made. Victims are directed to a counterfeit website hosted on the domain txtag-help.xyz, which mimics the legitimate TxTag service interface. This fake site is designed to harvest sensitive personal information, including credit card details, enabling identity theft and financial fraud. The campaign bypasses conventional email security filters by abusing trusted government infrastructure and domains, making automated detection challenging. The attackers rely heavily on psychological manipulation, exploiting fear and urgency to prompt victims to act without verifying the legitimacy of the request. Indicators of compromise include the IP address 43.166.239.78 and multiple URLs under txtag-help.xyz, such as /address, /login, and /pay, used to collect victim data. The campaign aligns with several MITRE ATT&CK techniques including spearphishing links (T1566.002), abuse of public-facing applications (T1608.004), domain acquisition (T1583.001), victim identity information gathering (T1589), social media account establishment (T1585.002), active scanning (T1595), phishing (T1598), and user execution of malicious links (T1204.001). No known exploits or CVEs are associated with this campaign, and it is currently assessed as medium severity. The campaign underscores the critical need for integrating human expertise into email security processes to detect sophisticated phishing attempts that evade automated detection mechanisms.

Detailed information about TxTag Takedown: Busting Phishing Email Schemes. Get real-time updates, technical details, and mitigation strategies.

TxTag Takedown: Busting Phishing Email Schemes - Live Threat Intelligence - Threat Radar | OffSeq.com

TxTag Takedown: Busting Phishing Email Schemes

The Trustwave SpiderLabs Email Security team has identified a significant increase in SVG image-based attacks, where seemingly harmless graphics are used to conceal dangerous links. Cybercriminals are exploiting the ability of SVG files to embed JavaScript, which can execute automatically upon opening. This technique has led to a 1800% increase in SVG-based phishing attacks in early 2025 compared to the previous year. The attacks are primarily driven by Phishing-as-a-Service (PhaaS) platforms like Tycoon2FA. These SVG files are particularly dangerous because they can bypass traditional security measures and appear innocuous to users. The blog post analyzes various techniques used in these attacks and provides recommendations for protection, including blocking SVG attachments, implementing advanced email security, and enhancing user awareness.

The identified threat involves a significant rise in phishing attacks leveraging SVG (Scalable Vector Graphics) files as the attack vector. SVG files are XML-based vector image formats that support embedding JavaScript code, which can execute automatically when the file is opened or rendered. Cybercriminals exploit this capability to embed malicious scripts within seemingly benign SVG images attached to phishing emails. These scripts can redirect users to malicious websites, steal credentials, or deliver additional payloads. The surge in these SVG-borne phishing attacks, noted as an 1800% increase in early 2025 compared to the previous year, is largely driven by Phishing-as-a-Service (PhaaS) platforms such as Tycoon2FA, which facilitate the rapid deployment and scaling of such campaigns. The embedded JavaScript allows attackers to bypass traditional email security filters that often focus on executable attachments or suspicious URLs, as SVG files are typically considered safe image formats. The obfuscation techniques used within the SVG files further complicate detection. Indicators of compromise include URLs and domains associated with these campaigns, such as grado33closet.com and ut.sxbmjefh.ru. Although no known exploits in the wild have been reported beyond these phishing campaigns, the threat represents a sophisticated evolution in social engineering tactics, combining technical exploitation of SVG capabilities with phishing strategies to compromise users. The threat is categorized as medium severity, reflecting its potential impact and ease of exploitation through email vectors without requiring user authentication but relying on user interaction (opening the SVG).

Detailed information about Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'email security'

Filter Threats

Threats Tagged 'email security'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility