New Phishing Attacks Bypass Secure Email Gateways Using Some Very Creative Methods

Phishing Attack Bypass Secure Email GatewayMicrosoft Security Intelligence warns of phishing attacks being sent from legitimate email addresses and IP ranges, taking advantage of gateway configuration settings to ensure delivery.

The bad guys know you have a layered defense sitting between them and your users. So, they look for ways to bypass any security controls by attempting to look legitimate. Microsoft’s warning highlights a few specific methods being used to accomplish this:

  • The bad guys have compromised and leverage over 400,000 Office 365 email accounts as the phishing sender. The use of legitimate email addresses and domains lowers the likelihood a gateway will stop a phishing email.
  • They also use compromised accounts from SendGrid and MailGun email delivery services, which many email gateways have listed as trusted senders.
  • They use Appspot to create multiple unique phishing URLs to evade domain reputation-based solutions.
  • They impersonate video conferencing solution notification emails.

The combination of these tactics adds up to some very successful phishing campaigns that make it all the way to a user’s Inbox.

The last line of defense here is the user, who can scrutinize the received emails, looking to see if they do any kind of business with the sender, if the email branding looks spoofed, and if the email is, in essence, unsolicited.

These simple checks are taught to users the undergo continual Security Awareness Training, helping to improve the security stance of their organization. The bad guys are obviously furiously working to get around your security solutions, so it’s time to put a human firewall layer in place through Security Awareness Training.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews