Weekly Threat Briefing: March 17–23, 2026
Surge in AI-generated phishing targeting financial services, new credential harvesting kit exploiting OAuth redirect flows, and community reporting hits all-time high.
Weekly phishing threat briefings, platform announcements, and research highlights from the vspam.org community. For machine-readable IOC data, subscribe to the threat feeds instead — these posts are the human-readable read of the same week.
Surge in AI-generated phishing targeting financial services, new credential harvesting kit exploiting OAuth redirect flows, and community reporting hits all-time high.
Record-breaking phishing kit takedowns, emergence of Telegram-based phishing-as-a-service, and DNSBL effectiveness study published.
New release adds HTTP check endpoint for universal MTA integration, supporting Exim, OpenSMTPD, Sendmail, and custom mail pipelines alongside existing Postfix support.
Every indicator named in a briefing is already in the feeds — usually hours before the post goes up. The blog is context, not the delivery channel.
Briefings are written by the community, and we do correct them. If a call looks wrong, mail research@vspam.org with the post slug.