Researchers find 18 “evasion exploits” within widely used email protocols, potentially letting attackers disguise spear-phishing attacks
Context & Ripple Effects
This research lands on email's most durable problem: the attack surface isn't one product but the shared protocols underneath all of them. Prior coverage has already mapped the edges of that surface — an Iran-linked campaign that phished US government officials past SMS-based 2FA, Zimbra server RCEs triggered simply by emailing the SMTP server, and iOS Mail bugs exploited against a Fortune 500 firm and a journalist.
What changes here is scope: instead of a bug in one vendor's codebase, the 18 exploits sit in widely used protocol behavior itself, meaning every mail client and gateway inherits them at once. It also echoes the Lapsus$ finding that unremarkable, long-standing weaknesses — not exotic zero-days — are what real intrusions run through.
First-order effects
- Email providers and gateway vendors must now audit how their parsers render sender identities and message content against 18 documented evasion techniques, while attackers get a ready-made playbook for disguising spear-phishing as legitimate traffic.
Second-order effects
- Security-filter vendors face reworked detection logic, because exploits that abuse legitimate protocol behavior defeat the signature-based heuristics those products were built on — pushing buyers toward stricter authentication and display policies.
Third-order effects
- If flaws this fundamental keep surfacing in shared mail infrastructure, the industry's answer trends toward protocol-level hardening — stronger sender-authentication defaults across clients and servers — rather than per-product patching, reshaping which mail platforms enterprises trust.
The trend: Email security is moving from fixing individual product vulnerabilities to confronting systemic trust assumptions baked into the mail protocols themselves.