GC Solar and SEG-T Launch Development of AI-Powered Security Email Gateway SEG-T to Counter Advanced Phishing Campaigns
GC Solar and SEG-T have announced the launch of a new Security Email Gateway solution aimed at strengthening corporate email protection through advanced multi-agent AI filtering. The initiative is led by co-founder of Secure-T, Khariton Nikishkin, with support from GC Solar, and directly addresses the rapid growth of sophisticated phishing campaigns that increasingly rely on pre-built toolkits and artificial intelligence.
Modern phishing operations now combine ready-made components such as management panels, distribution infrastructure, anti-bot mechanisms, and one-time code interception modules. Attackers further enhance these campaigns by using AI to generate more convincing messages and scale their reach. SEG-T is being developed to go beyond conventional technical analysis by evaluating the semantic content of emails, including tone, signs of psychological manipulation, attempts to establish trust, create fear, or pressure recipients into immediate action.
The gateway will automatically block messages containing potentially dangerous elements such as links, archives, PDF files, executable files, SVG images, and other attachments that could carry malicious content. Developers have decided against including a built-in sandbox, arguing that the majority of current attacks rely on social engineering rather than malware code. However, the solution will allow integration with external sandboxes for high-risk attachments when needed.
SEG-T is designed to work seamlessly with other GC Solar products, including Solar webProxy for traffic inspection and Solar Dozor for monitoring the transmission of sensitive personal data such as INN, SNILS, passport details, and bank card numbers.
The platform will be available in multiple deployment models: cloud, on-premises networks, and Kubernetes environments. According to the developers, initial setup and commissioning of SEG-T should take approximately 15 minutes. GC Solar owns 49% of the project and previously increased its stake in Secure-T to a controlling interest. The new product continues the company’s strategic focus on defending against phishing, spam, malicious mailings, and targeted attacks on corporate email systems.
Related articles
Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group will hold its ninth annual General Meeting on November 5-6, 2026, in Tokyo as a hybrid event focused on evolving messaging security challenges. Keynote speaker Tom Bartel from M3AAWG will address worldwide anti-abuse trends and the practical realities of AI-powered attacks and defenses. Sessions will cover the recently standardized DMARCbis specification under RFC 9989, ongoing work on DKIM2 to counter replay attacks, BIMI logo display adoption, and sender guidelines for AI-generated email summaries. Practical workshops will teach DMARC report analysis using real sample data along with related technologies such as ARC, DNSSEC, and MTA-STS. Government agencies including the National Police Agency and Ministry of Internal Affairs and Communications will also present, alongside a dedicated track on post-quantum cryptography.
Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.