Attackers send authenticated phishing through Dell, Staples and other platforms
Original title: Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
Cisco Talos saw about 1,400 Dell and Staples messages that planted callback numbers in order fields.
Cisco Talos says attackers abused more than 25 legitimate platforms over the past year so phishing content arrives in mail that passes SPF, DKIM, and DMARC. In Dell and Staples campaigns, fake support numbers placed in billing or shipping fields turned genuine order confirmations into callback scams. Other cases put lures in registration-form fields or inside bounced-mail notices, including a WeTransfer-themed file-sharing lure. Talos says platforms should reject unexpected phone numbers, URLs, and markup before rendering them into email.
- The two transactional-mail campaigns totaled roughly 1,400 messages, including a fake $736.09 Dell order.
- That Dell message used Dell’s order domain and template and passed DKIM and DMARC.
- List bombing can carry a lure typed into a name, company, or title field.
- A delivery-failure notice can echo a malicious payload through backscatter or a triggered bounce.
- Talos urges recursive inspection of DSN containers and nested message fragments.
Impact: Authenticated emails deliver callback-scam numbers and phishing lures
- 1.Reject or flag phone numbers, URLs, markup, and urgent language in fields where they do not belong.
- 2.Inspect fully rendered mail, including HTML, URLs, attachments, personalization fields, and nested MIME content.
- 3.Parse delivery-status containers and analyze returned message fragments for phishing and malware.
- Organizations
- Cisco Talos
From the original article
3 min read at helpnetsecurity.com
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736. 09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should be, sits the word “Helpline” and a phone number – the hook for a callback scam.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.