When Zero-Days Linger and Email Rules Turn Malicious: This Week's Security Reality Check

Page content

When Zero-Days Linger and Email Rules Turn Malicious: This Week’s Security Reality Check

It’s been one of those weeks where every coffee break conversation seems to circle back to the same uncomfortable truth: attackers are getting better at staying hidden, and some of our most trusted tools are becoming their favorite weapons.

Let me walk you through what caught my attention this week, because honestly, a few of these stories made me immediately check our own configurations.

The Adobe Zero-Day That Wouldn’t Die

Here’s what’s keeping me up at night: Adobe just patched a zero-day that attackers have been actively exploiting for at least four months. Four months. That’s not a quick hit-and-run operation – that’s attackers setting up shop and getting comfortable.

The attack vector? Maliciously crafted PDF files targeting Adobe Acrobat and Reader. I know what you’re thinking – “who still clicks random PDFs?” – but let’s be honest, PDFs are everywhere in corporate environments. Financial reports, contracts, technical documentation. They’re the digital equivalent of air; we barely notice them until something goes wrong.

What really bothers me about this one is the timeline. Four months of active exploitation means this wasn’t some sophisticated nation-state tool that got burned after one use. This was a reliable method that probably got passed around, refined, and used repeatedly. The fact that it took this long to surface publicly makes me wonder how many other long-running zero-days are out there right now.

When Email Rules Become the Enemy

Speaking of things that make me paranoid, researchers are now warning about attackers abusing Microsoft 365 mailbox rules for post-compromise persistence. This one hits different because it’s not about breaking in – it’s about what happens after they’re already inside.

The technique is elegantly simple and terrifyingly effective. Once attackers compromise an account, they create mailbox rules to automatically forward sensitive emails, hide their activities, or maintain access even after password resets. It’s like leaving a spare key under the doormat, except the doormat is invisible and the key works even after you change the locks.

What makes this particularly nasty is that mailbox rules are legitimate functionality. Users create them all the time for organizing email or setting up forwarding. So when security teams are hunting for threats, these malicious rules blend right in with normal administrative activity. It’s the digital equivalent of hiding in plain sight.

The Booking.com Breach and Supply Chain Ripples

Booking.com’s recent breach is another reminder that our interconnected world means one company’s security incident becomes everyone’s problem. While they’ve contained the issue, the lack of specifics about how many customers were affected is telling. In my experience, when companies are vague about numbers, it’s usually because the numbers are uncomfortable.

This connects to another story that caught my eye: Rockstar Games got hit through a third-party analytics provider. The ShinyHunters gang compromised Anodot, then used that access to get at Rockstar’s data. It’s supply chain attacks all the way down.

These incidents highlight something we all know but don’t always act on: our security is only as strong as our weakest vendor. Every SaaS tool, every analytics platform, every third-party integration is a potential entry point. The question isn’t whether one of our vendors will get breached – it’s when, and whether we’ll know about it in time to respond.

A Rare Win: Taking Down W3LL

Not everything this week was doom and gloom. The FBI and Indonesian police dismantled the W3LL phishing operation, which was responsible for over $20 million in attempted fraud. They even arrested the alleged developer.

W3LL was essentially phishing-as-a-service – an off-the-shelf toolkit that let less technical criminals run sophisticated credential theft campaigns. The international cooperation here gives me hope, but it also highlights how industrialized cybercrime has become. When you can buy a phishing kit like you’d buy software, the barrier to entry for cybercrime gets dangerously low.

What This Means for Us

Looking at these stories together, I see a few patterns that should inform how we think about defense. First, persistence is becoming more important than initial access. Attackers are investing in techniques that let them stay hidden for months, not days.

Second, legitimate functionality is increasingly being weaponized. PDF files, email rules, vendor relationships – all normal parts of business operations that can be turned against us. This makes detection harder because we can’t just block the tools; we need to understand the behavior.

Finally, the supply chain remains our biggest blind spot. We can harden our own systems all we want, but if our vendors get compromised, we’re still at risk.

The good news? These aren’t unsolvable problems. They just require us to think differently about security – less about building walls and more about understanding what normal looks like so we can spot the abnormal.

Sources