Namecheap/SendGrid Hijack: Phishing With Perfect DMARC
Phishers compromised a SendGrid supplier account and sent MetaMask-themed mail through Namecheap’s legitimate pipeline — SPF, DKIM, and DMARC all passed.
Barracuda ESG Hack: When Patching Isn’t Enough
CVE-2023-2868 gave pre-auth RCE in Barracuda’s email gateways via spreadsheet parsing, exploited since October 2022. The final verdict: replace every appliance. Remediation doctrine lessons.
SMTP Smuggling: Spoofing Email With Authenticated Mail
December 2023 brought one of email’s most elegant attacks: SMTP smuggling, a parser-level desync that tricks receiving servers into writing attacker-authored messages that pass SPF and DMARC because the victim’s own infrastructure vouches for them. This deep dive covers the technique mechanics (end-of-data ambiguity, the second hidden MAIL FROM conversation), the December 19 disclosure and DHL demonstration, the two anchoring CVEs, which product families patched, and the durable lessons for mail admins running anything that speaks SMTP.
Fake FBI Warnings: The 2021 fbi.gov Email Spoofing
Attackers abused a misconfigured FBI notification system to spam fake cyber-warnings from the real fbi.gov address, exposing the limits of email trust.