← All issues

This Week In Email — October 28, 2026

A $14.7 million wire fraud against a city government, Spamhaus putting documented teeth behind "best practices," and two separate reports this week on attackers riding trusted infrastructure straight past your filters. It's a lot. Let's get into it.

In This Issue

Top Stories

BEC Drains $14.7M from the City of Mobile, Alabama

The City of Mobile wired $14.7 million earmarked for arena construction to a fraudulent account after scammers spoofed phone numbers and copied legitimate email addresses to impersonate a real vendor. The fraud happened in early October. The mayor found out roughly three weeks later. One employee has been fired, two more are on leave, and the FBI and Secret Service are now involved.

Nobody got "hacked" here in the technical sense. Nothing was breached. Somebody just believed an email and a phone call that looked exactly like the real thing, and $14.7 million of public money left the building.

This is what a "simple" vendor-impersonation BEC actually costs when nobody catches it before the wire goes out. If your organization handles payments over email — and whose doesn't — this is the case study to put in front of finance, not another generic phishing-awareness slide.

Sources: AL.com/APR, Oct 27, 2026, FOX10, Oct 21, 2026, City of Mobile official statement

Spamhaus Formalizes Sender Guidelines — With a November Deadline

Spamhaus just published three separate guideline documents — general, individual-sender, and ESP/large-scale-sender — and for the first time, it's documented requirements instead of folk wisdom passed around at conferences. The list: FCrDNS on every sending IP, HELO/EHLO hostnames that actually resolve, IPv6 /64 reverse-DNS, SPF and DMARC on every sending domain, DKIM alignment, confirmed opt-in, bounce rates under 5%, and one-click unsubscribe.

The headline change: a rolling requirement that every sending IP carry valid HELO and reverse DNS begins in November 2026. That's an actionable deadline, not aspirational guidance. Word to the Wise calls the documents "very clear, very precise and generally very good" — which, from a deliverability blog that doesn't hand out praise lightly, is worth noticing.

If you've been treating reverse DNS and HELO hygiene as a someday-task, someday just got a date on it. Audit your sending infrastructure against all three documents this week, not after the first blocklisting.

JOB BOARD UPDATE Early Cancellation Just Got Easier on the TWIE Job Board Booked a paid listing and need to pull it? You can now cancel it yourself, right from where you booked it — no email to me required — and the unused balance converts to a credit toward a future listing instead of getting forfeited. Worth remembering while you're at it: every listing reaches 248 subscribers, and they're all working email-industry professionals — deliverability engineers, ESP and MTA staff, mail admins, martech — not a general-audience job board firehose, so you're not fielding a flood of unqualified applicants. Post a job →

Source: Spamhaus Sender Guidelines, Word to the Wise commentary, Oct 22, 2026

Security & Anti-Abuse

Cisco Talos: Attackers Are Weaponizing 25+ SaaS Platforms' Own Pipelines

Last week's KnowBe4 LOTS report quantified how often phishing abuses trusted platforms. This week Cisco Talos goes deeper on the mechanism, and it's uglier than "trusted sender gets spoofed." Attackers injected malicious phone numbers directly into roughly 1,400 real Staples and Dell order-confirmation emails to run callback scams. They're exploiting unvalidated registration-form fields to turn legitimate "welcome" emails into list-bombing payload carriers. And they're weaponizing bounce and DSN messages so a phishing lure arrives disguised as a routine delivery failure.

The through-line across all three: authentication confirms where a message came from, not whether the trusted platform's own content got poisoned by attacker-supplied input. SPF, DKIM, and DMARC all pass on these messages. That's the point.

If your filtering logic trusts a sender just because DKIM and DMARC pass, this is this month's reminder that's not enough — and it won't be the last one.

Sources: Cisco Talos, "Parasitizing trust," Oct 21, 2026, Help Net Security recap, Oct 22, 2026

Microsoft 365 Token-Replay Campaign Hits 97 Accounts Without a Single Password

Here's the number that should get your attention: zero passwords stolen, 97 accounts compromised anyway. Huntress tracked an adversary-in-the-middle campaign running July 14 through September 22, 2026, that captured post-login session tokens — issued after MFA already succeeded — and replayed them from attacker-controlled devices within minutes. Over 200,000 login attempts hit the campaign's infrastructure, hosted on IP space owned by German provider 1337 Services GmbH. At least 48 rogue devices got registered directly in victims' Entra directories, at 79 organizations.

MFA was never the weak point here. The session token issued after MFA succeeded was. "Token spraying" — reusing stolen auth artifacts across many organizations instead of guessing passwords one at a time — is the mechanism to watch for in your own SOC alerts.

We've spent years telling people MFA solves credential theft. It solves credential theft. It does not solve session theft, and attackers have clearly noticed the difference before most defenders have.

Sources: Huntress, The Hacker News, Oct 2026, Help Net Security, Oct 23, 2026

Regulatory & Compliance

Yahoo's "Consent or Pay" Model Lands on Mail

Starting January 28, 2027 for the UK and March 18, 2027 for the rest of the EU/EEA, Yahoo will force users to pick: ad-supported access with personalized ads, or a €2.49-a-month ad-free subscription across Mail, News, Sports, Finance, and the rest of its core services. Even the paid tier still allows non-personalized sponsored messages — "ad-free" has an asterisk.

This is the same "consent or pay" pattern EU regulators have already forced onto Meta and others. The difference is that this time it lands directly on a top-tier consumer mailbox — Yahoo Mail — not just a social feed.

Watch this space for how EU and UK Yahoo Mail users actually behave once the choice screen appears, and whether marketing email engagement from that user base shifts once a chunk of them are paying specifically to see less of it.

Source: AlternativeTo news writeup, Yahoo's EEA/UK ToS update

Events & Community

Links worth your time

That's the week. If something is wrong, reply and tell me — I read every response.

— John

This Week In Email — thisweekin.email

Enjoyed this issue?

Subscribe to This Week in Email and get future issues delivered to your inbox.