A phishing campaign is currently circulating that impersonates internal email security notifications, deceiving employees into thinking the messages are legitimate alerts from within their organization.
According to researchers from Unit 42, the fraudulent emails claim that several incoming messages have been blocked or quarantined and urge the recipient to click a link to “release” them.
The emails appear to come from the recipient’s own domain, using spoofed sender addresses to bypass initial suspicion.
By replicating the tone, layout, and branding of authentic corporate alerts, the attackers successfully exploit the trust users place in internal IT communications. The messages often use subject lines that suggest message delivery failures or security alerts, tricking recipients into clicking malicious links.
Prefilled Webmail Pages Capture Credentials
The embedded links in these messages redirect victims to fake webmail login portals meticulously designed to mimic legitimate platforms such as Microsoft 365, Outlook Web Access, or cPanel.
In many instances, the fake login pages automatically populate the victim’s corporate email address, prompting only for the password. This tactic lowers suspicion and accelerates the credential theft process.
Once entered, the credentials are transmitted to servers controlled by the attackers, who can immediately use them to access the victim’s mailbox.
Compromised accounts are then exploited to send additional phishing messages, conduct internal reconnaissance, or siphon sensitive business data.
Analysis revealed that these phishing sites often reside on compromised web servers and use free SSL certificates to appear secure. Some kits even dynamically modify logos and interface colors to resemble the target organization’s email service, further strengthening the deception.
Technical Tactics and Defensive Measures
The technical inspection of the campaign reveals forged “Reply-To” and “Return-Path” headers crafted to appear trustworthy. Many phishing domains use structures resembling legitimate mail systems, such as “secure,” “release-message,” or “portal,” to lend authenticity.
The use of HTTPS with Let’s Encrypt certificates further enhances user confidence, as victims often associate the padlock icon with safety rather than verifying domain ownership or intent.
To counter these tactics, organizations are advised to harden their domain configurations by enabling DMARC, DKIM, and SPF to reduce exposure to spoofing.
Security administrators should review mail logs for internal-looking messages referencing message release requests and alert staff to inspect URLs before entering login credentials.
Implementing multifactor authentication remains one of the most effective measures to mitigate credential theft, as stolen passwords alone cannot provide full account access.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
