Best Of The Worst: The Week Your Security Tools Became The Disguise
Security Boulevard, Monday, April 6th, 2026
This week's Attack of the Day posts revealed a clear pattern: attackers are deliberately routing attacks through legitimate security and platform infrastructure so the tools themselves become trust signals. TitanHQ and Cisco URL wrappers hid a malware payload.
Microsoft Safe Links rewrote a phishing URL to look protected. Microsoft Bookings sent a phishing email that passed every authentication check. A Google Calendar invite delivered a vishing attack with no scannable payload at all. And a BEC targeting a public utility passed SPF and DMARC while DKIM body-hash verification quietly failed, a signal most gateways ignore. The common thread: authentication confirms origin, not intent, and legitimate infrastructure is the new attack surface.