← All issues

This Week In Email — October 14, 2026

A quieter week on the headline front, but a genuinely important authentication story, a nine-figure-adjacent litigation number, and hard data on the phishing technique that's sailing past your secure email gateway right now.

In This Issue

Top Stories

Apple iCloud Mail Header-Smuggling Bugs Let Attackers Spoof Any @icloud.com Sender Past SPF, DKIM and DMARC

Security researcher Timo Longin — the same person behind prior SMTP-smuggling research — published full details on October 1 of two parsing flaws in Apple's iCloud Mail infrastructure. The bugs exploited differences in how Apple's components interpreted malformed From: headers, specifically standalone carriage-return characters that got normalized inconsistently downstream. The result: any authenticated iCloud user could send mail that appeared to come from any other @icloud.com address — including high-profile ones — while passing SPF, DKIM and DMARC cleanly.

Apple fixed it in December 2025, after an embarrassingly narrow early patch that only blocked the literal word "admin." Longin got a $15,000 bounty. Full disclosure and wider press pickup landed this week.

Here's the part worth sitting with: this isn't a case of one protocol failing. SPF passed. DKIM passed. DMARC passed. The failure was in header parsing — a layer underneath all three checks that nobody treats as part of the authentication story, right up until it defeats all of it at once. If you've been telling stakeholders that passing authentication equals "verified safe," this is the counterexample to keep in your back pocket.

Sources: SEC Consult, SC World, CyberInsider

Costco's $14M Washington CEMA Settlement Gets Final Court Approval

Following up on last week's coverage of Washington courts remanding the PacSun, Tommy Bahama and Bebe CEMA suits back to state court, there's now a dollar figure attached to what this litigation wave actually costs. A King County judge gave final approval this week to Costco's $14 million settlement in Aaland v. Costco Wholesale Corp.

The claims: subject lines like "5 days only" and "last day" violated Washington's Commercial Electronic Mail Act when the underlying promotions ran longer than advertised. The settlement covers roughly 3.5 million Washington residents who received the emails between June 2021 and July 2025. About 313,275 claims have been approved, netting claimants roughly $30 each, while plaintiffs' counsel takes $4.6 million in fees. Costco denies wrongdoing — that's standard, and also irrelevant to the check it's writing.

Washington did lower CEMA's statutory damages from $500 to $100 per email via HB 2274, effective June 11, 2026 — but not retroactively, and this case was filed under the old cap. The lesson for anyone still running fake-deadline subject lines: Washington courts aren't dismissing these suits, and now there's a real number showing what losing one costs at scale. Clean up your urgency copy before your legal team finds out the hard way.

Sources: Kelley Drye, KIRO 7, Law360

KnowBe4: "Living Off Trusted Services" Now Accounts for 1 in 10 Phishing Emails

KnowBe4's threat lab tracked 544,000 threat emails between June and August 2026. Of those, 53,000 — nearly 1 in 10 — were LOTS attacks (Living Off Trusted Services): phishing that abuses legitimate platforms like DocuSign, QuickBooks, Google Drive, Adobe Sign and SharePoint to host the actual payload.

DocuSign (32.3%) and QuickBooks (30.6%) alone account for almost two-thirds of that volume. The mechanism is simple and nasty: a real "Review Document" or "Sign Now" button, from a real high-reputation sending domain, that exits to a fake Microsoft or Google login via credential harvesters or AiTM (adversary-in-the-middle) proxies.

The reason this works is the same reason a lot of orgs feel safe: secure email gateways routinely allowlist DocuSign, QuickBooks and similar SaaS platforms specifically because they're "trusted." That trust is exactly what's being weaponized. If your SEG policy treats sender reputation as a proxy for message safety, this data says you need a second layer that looks at what the message is actually asking the recipient to do — not just who it claims to be from.

Source: KnowBe4 Blog

Links Worth Your Time

Events & Community

That's the week. If something is wrong, reply and tell me — I read every response.

— John

This Week In Email — thisweekin.email

Enjoyed this issue?

Subscribe to This Week in Email and get future issues delivered to your inbox.