Cybercriminals are increasingly using trusted-looking senders, multi-stage redirect chains, and obfuscated URLs to bypass email security tools, according to Virus Bulletin’s Q3 2026 VBSpam test.
The 16-day test examined 11 publicly tested email-security products against 103,969 emails, including 103,380 spam messages.
While leading products recorded phishing detection rates near 100%, the test showed that attackers are moving away from malicious attachments and using browser-based phishing flows instead.
These campaigns often begin with convincing messages about invoices, banking access, antivirus subscriptions, or account renewal.
The malicious action happens only after a victim clicks a link and passes through several websites. This approach can make the email itself appear harmless during initial analysis.
Trusted Senders Mask Phishing
One phishing campaign impersonated McAfee and TotalAV in Dutch-language emails. The messages claimed that recipients’ devices contained “631 dangerous viruses” and offered a 90% discount on antivirus renewal.
The emails used urgent warnings and account-closure threats to pressure users into clicking. Instead of including malware, the campaign used HTML-only content and redirect infrastructure.
Links passed through domains such as loadswage[.]com and eightindigostove[.]com before reaching a likely scam or subscription-fraud destination. The goal was likely to collect payment details or generate affiliate revenue.
Another campaign used a German overdue-invoice lure and was delivered through Amazon Simple Email Service using the DKIM-aligned domain moolaah[.]com.
The email claimed to contain a payment reminder, but it had no attachment. Its link opened a webpage containing hidden text, a zero-size iframe, and obfuscated JavaScript.
The page collected browser and timezone information before making a hidden POST request. It later redirected to OpenSea, suggesting a cloaked cryptocurrency or NFT fraud operation.
Such browser fingerprinting can identify security crawlers, sandboxes, and automated scanners, allowing attackers to serve harmless content to analysis systems while showing fraudulent pages to real users.
A third campaign targeted Romanian banking users with a fake PSD2 consent-renewal request impersonating BCR S.A. The email warned that online and mobile banking access would be restricted unless the victim acted quickly.
Its URL used IPv6-mapped notation to hide the underlying IPv4 address, 103[.]193[.]179[.]223, before redirecting through another domain.
The VBSpam test found that several enterprise email-security products maintained strong protection despite these tactics.
Net at Work NoSpamProxy achieved the highest final score at 99.995, with a 99.990% phishing catch rate and no false positives.
Bitdefender GravityZone Premium followed with a 99.994 final score, blocking all malware and detecting 99.970% of phishing emails.
SEPPmail.cloudfilter, Fortinet FortiMail, N-able Mail Assure, and N-able SpamExperts also achieved VBSpam+ certification. Bluepex Mail Security, Coro Email Security, and Zoho Mail received VBSpam certification, virusbulletin said.
However, the test highlights a wider challenge: authenticated email delivery does not make a message safe.
Attackers can use DKIM-aligned domains, legitimate cloud email services, polished branding, and clean-looking messages to gain trust.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
