Phishing Attacks Bypass Security With Trusted Email and URL Cloaking

Key Takeaways

• Sophisticated phishing campaigns are leveraging trusted email infrastructure and advanced URL cloaking techniques to bypass conventional security defenses.
• Attackers are sending seemingly legitimate emails, such as account alerts or invoices, from authenticated domains, making them difficult for automated filters to detect.
• The attacks utilize multi-stage redirect chains, browser fingerprinting, and dynamic content delivery to present benign content to security scanners while delivering malicious payloads or phishing pages to human users.
• The primary goals of these campaigns include credential theft, payment fraud, and cryptocurrency/NFT fraud, rather than direct malware delivery.
• Defenders must adopt advanced detection methods that analyze the entire click path and post-load behavior of URLs, rather than relying solely on initial email checks.

A new wave of phishing attacks is circumventing traditional email security measures by originating from trusted email systems and employing sophisticated URL cloaking. Instead of relying on obviously malicious sender addresses, these campaigns mimic legitimate communications, such as account notifications, invoices, and renewal reminders, to lure victims into web-based traps.

This evolving strategy shifts the point of compromise into a dynamic click path that can adapt in real-time. An email might successfully pass authentication checks and contain no malicious attachments, yet it can still guide a recipient through a series of redirects, browser fingerprinting, and deceptive landing pages designed to harvest sensitive information.

During its Q3 2026 testing period, researchers identified phishing samples utilizing this model. These campaigns cleverly combined familiar social engineering themes with infrastructure specifically designed to conceal the ultimate malicious destination from automated security checks. The findings are detailed in a report shared with Cyber Security News (CSN) by Virus Bulletin, which highlights the critical challenge these attacks pose to existing security paradigms.

The implications of these tactics extend beyond a single deceptive email. A fraudulent antivirus renewal notification might aim to steal payment card details, an overdue invoice could steer a victim toward cryptocurrency-related scams, and a fake banking alert could target login credentials. As Virus Bulletin said in a report, each of these scenarios leverages a believable prompt and a destination that can exhibit different behaviors when accessed by security scanners versus a human user.

New Phishing Attacks Use Trusted Email Infrastructure

An incident observed in August involved a German-language email concerning an overdue payment, urging recipients to open a “Mahnschreiben” (payment reminder). This message was delivered via Amazon Simple Email Service (SES) from a domain with a valid DKIM signature, leading many email filters to classify it as legitimate.

Notably, the email contained no attachment for security systems to inspect. Instead, the embedded link led to a page featuring decoy content, hidden text, a minuscule iframe, and obfuscated code. This page meticulously collected browser and time-zone data from the user. Following this, it initiated a hidden request before redirecting to OpenSea during analysis, indicating a cloaked path toward cryptocurrency or NFT fraud rather than the delivery of malware.

This attack vector underscores why leveraging trusted cloud services is so effective for phishing. The email delivery platform itself can be legitimate, the sending domain can pass authentication checks, and the initial landing page might appear harmless when examined outside the specific browser, geographical location, or time intended by the attacker. This sophisticated cloaking mechanism allows malicious content to remain hidden until the precise conditions for the target are met.

Another campaign, written in Romanian, mimicked the branding of BCR S.A. and falsely claimed that a PSD2 consent renewal was necessary to prevent banking access restrictions. This email, while DKIM-aligned, originated from an unrelated sender domain. The embedded link utilized an IPv6-mapped address, a format that complicates automated assessment of the destination. During verification, this link resolved through an additional redirect before eventually landing on Google, further obscuring its true purpose.

Researchers concluded that this operation aimed for credential theft. They noted that the active phishing page might have expired, been cloaked, or been configured to display benign content selectively. This inherent uncertainty renders simple reputation lookups and one-time scans significantly less effective against such adaptive threats.

Why Familiar Lures Still Work

These phishing campaigns do not necessitate novel malware to achieve their objectives. They effectively exploit universal human anxieties: an infected device, an outstanding bill, restricted banking access, or an expiring subscription. For instance, a Dutch-language renewal email falsely warned of “631 dangerous viruses,” threatened account closure, and offered a discount to pressure victims into a hasty decision.

These messages capitalize on a fundamental disconnect between technical email authentication and human trust. While passing SPF, DKIM, or DMARC verifies that an email originated from an authorized domain, it offers no guarantee regarding the legitimacy of the underlying business request. The Amazon SES phishing example demonstrates this perfectly, where technically authenticated mail was weaponized to bypass reputation-based blocking mechanisms.

What You Should Do

• Verify Independently: Never click on links in unexpected emails for invoices, renewal notices, or banking updates, even if the sender appears legitimate. Instead, navigate directly to the service’s official website by typing its known address or using a saved application.
• Confirm Alerts In-Account: If an email alerts you to an issue, log into your account directly through official channels to verify the notification. This prevents engagement with malicious redirect chains.
• Enable Multi-Factor Authentication (MFA): Implement MFA on all critical accounts to add an essential layer of security, making it significantly harder for attackers to compromise accounts even if they obtain credentials.
• Advanced Email Gateway Configuration: Security teams should configure email gateways to inspect the *entire* click path, including redirects, unusual IP-based links, browser fingerprinting attempts, and post-load behavior. Relying solely on initial URL checks is insufficient.
• Employee Training and Awareness: Regularly educate staff on the latest phishing tactics, emphasizing the dangers of urgent requests and the importance of verifying sender legitimacy and link authenticity independently.
• Threat Hunting: Actively hunt for indicators of compromise (IoCs) related to these advanced phishing techniques. Review messages that mimic payment, banking, or renewal workflows for suspicious elements.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.