From trust to trickery: Brand impersonation over the email attack vector

Cisco Talos details how phishing campaigns impersonate popular brands in email by embedding logos via HTML tricks, base64, remote URIs, and inline attachments (PNG/PDF), and shares March–April 2024 telemetry on sender domains, targeted industries, and the most abused brands (led by Microsoft and DocuSign). The report highlights telephone-oriented callback phishing trends, shows that free email services and varied domains are commonly used, and emphasizes layered defenses: user education, domain/asset protection, and advanced ML-based detection in Cisco Secure Email Threat Defense.