The Blind Spot in Modern Email Security
Summary: A Hacker News piece by Doppel CTO Rahul Madduluri argues that email security tools score messages after they land, while attackers have already registered lookalike domains with valid SSL certificates, warmed sending domains past SPF and DKIM, and built fake executive LinkedIn profiles. The article cites a median 21 seconds to click a phishing link and 28 more seconds to hand over credentials, and attributes roughly 14.6% of reported 2025 cybercrime losses, over $3 billion, to business email compromise alone.
Why it matters: Under a minute from open to credential handover means quarantine decisions arrive after the loss, and the same sending domain, fake profile, and link get reused against the next employee or a vendor down the supply chain. The $3 billion BEC figure is one category inside a broader loss total that has grown sharply year over year.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026