JPAAWG 9th General Meeting to Examine AI-Driven Messaging Threats and Global Standards in Tokyo
The Japan Anti-Abuse Working Group (JPAAWG) will convene its 9th General Meeting on November 5 and 6, 2026, in Tokyo as a hybrid event centered on the rapidly changing landscape of messaging security.
Following the accelerated evolution of AI since the second half of 2026, email and messaging environments face increasingly sophisticated threats. The two-day program brings together international experts, researchers, and practitioners to share the latest global developments and operational know-how.
Keynote speaker Tom Bartel of M3AAWG will present on worldwide messaging abuse countermeasures and the current state of AI-enabled attacks and defenses. Additional sessions will introduce IETF standardization efforts, including the revised DMARC specification published as RFC 9989 (DMARCbis) in May 2026 and work toward DKIM2 to mitigate DKIM replay attacks.
Experts will also discuss phishing trends and countermeasures, sender authentication guidelines, and the adoption status of BIMI for displaying sender logos. Sessions will address the implications of AI-driven email summarization and filtering for senders.
Practical tracks will cover foundational topics such as email architecture and DNS, followed by hands-on DMARC report analysis using real-world sample data. Participants will learn to interpret reports and apply findings operationally, with coverage of ARC, BIMI, DNSSEC, and MTA-STS.
Roundtable discussions will allow attendees to exchange experiences and challenges directly. Government sessions featuring the National Police Agency, Ministry of Internal Affairs and Communications, and Public Security Intelligence Agency are planned, along with a dedicated program on post-quantum cryptography.
The venue is Otemachi Place Hall & Conference. Select sessions will be streamed online, while others are limited to in-person participants. Attendance is free but requires advance registration via the official event website.
Related articles
Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams
Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.
SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing
The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.
Cybercriminals Use Fake WatchGuard VPN Support Site to Steal Credentials Through SEO Poisoning
Cybercriminals created a counterfeit WatchGuard support website that tricked users into entering their VPN server address, username, and password before delivering the legitimate installer. The Huntress team discovered the phishing page while investigating an October 7 incident at a managed service provider. Victims reached the site through Bing search results for terms such as watchguard vpn sll download, which redirected them to the malicious domain watchguard-vpn.net. The page mimicked the official support structure, including FAQs and a download button that led to a credential-harvesting form. The first submission always failed with an Incorrect data message, prompting victims to re-enter their details, after which the real signed client WG-MVPN-SSL_12_11_5.exe was provided. A 150-line JavaScript script silently exfiltrated the credentials via HTTP POST to a secondary domain, leaving no visible signs of compromise on the victim's system. The site, which claimed to be an independent fan site, was taken offline on October 13.
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.