New Phishing Attacks Use Trusted Email Infrastructure and URL Cloaking to Bypass Security Tools
Virus Bulletin Q3 2026 report details phishing using DKIM-aligned senders, Amazon SES delivery, and real-time URL cloaking to evade email security and scanners.
Virus Bulletin's Q3 2026 testing found phishing campaigns delivered through trusted infrastructure like Amazon SES with DKIM-aligned sender domains. Samples included a German overdue-invoice lure redirecting to OpenSea crypto fraud and a Romanian BCR-branded PSD2 banking credential-theft campaign. Cloaking pages used hidden iframes, browser fingerprinting, and time-zone checks to show different content to scanners versus victims. Defenders are urged to inspect full redirect chains rather than attachments or initial URLs alone.
- DKIM-aligned senders and Amazon SES defeat reputation-based email filtering
- Cloaking pages fingerprint browsers and selectively show benign content to scanners
- Lures include antivirus renewals, overdue invoices, and PSD2 banking consent
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 31-59-175-195.syd.nbn.aussiebb.net | of compromise (IoCs):- Type Indicator Description Hostname 31-59-175-195[.]syd[.]nbn[.]aussiebb[.]net Redirect infrastructure used in the antivirus renew |
| domain | eightindigostove.com | ssociated with the antivirus renewal phishing sample Domain eightindigostove[.]com Domain hosting the unsubscribe path in the antivirus rene |
| domain | loadswage.com | sed in the antivirus renewal scareware phishing flow Domain loadswage[.]com Redirect infrastructure associated with the antivirus ren |
| domain | moolaah.com | path in the antivirus renewal phishing sample Sender domain moolaah[.]com DKIM-aligned sender domain used for the cloaked overdue-p |
| domain | opensea.io | ing page used in the invoice phishing redirect chain Domain opensea[.]io Final destination reached after the cloaking and browser- |
| domain | web5-4s4c-online-garantibbva.vibtee.com | Pv4 address represented by the IPv6-mapped URL notation URL web5-4s4c-online-garantibbva[.]vibtee[.]com/ro/ Redirect destination in the Romanian PSD2 banking p |
| domain | website-2df62808.mvplineup.com | omain used for the cloaked overdue-payment invoice lure URL website-2df62808[.]mvplineup[.]com/audacity/underside First-stage cloaking page used in th |
| domain | xmasbrick.com | the cloaking and browser-fingerprinting stage Sender domain xmasbrick[.]com DKIM-aligned but unrelated sender domain used in the Roma |
| ipv4 | 103.193.179.223 | l URL embedded in the banking phishing message IPv4 address 103[.]193[.]179[.]223 IPv4 address represented by the IPv6-mapped URL notat |
| url | http://[0000:0000:0000:0000:0000:FFFF:67C1:B3DF | nder domain used in the Romanian banking phishing email URL hxxp://[0000:0000:0000:0000:0000:FFFF:67C1:B3DF]/11881659 IPv6-mapped IP-literal URL embedded in the bankin |
From the original article
4 min read at cybersecuritynews.com
Phishing is arriving via trusted email systems. Instead of using obvious malicious addresses, attackers send ordinary account alerts, invoices and renewal notices that lead victims into web-based traps. The approach moves danger into a click path that can change in real time.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.