Are We Going Back to Square One, When Phishing Emails Pass Authentication?

Inbox view showing several “quick question” emails from a sender named Valerie, received across late July and August from different email domains.

I drafted this article all the way in August from a series of phishing emails that caught my eye. It was new to me and I saw a pattern. I then saw something that we could all learn from especially companies that provide and use mass mailing services.

I have noticed what looks like a new strategy by phishing email scammers. They have studied the very frameworks developed to combat their attempts to scam others and have adapted their efforts to blend. My aim is to alert those of us who are not aware so we are more careful on how this could hurt our business.

Up until the early 2000s, phishing emails were having a field day, and many persons did not even know they were being tricked, especially by those that impersonated financial institutions or businesses.

Between 2003 and 2012, three important email authentication frameworks were being developed. Sender Policy Framework's (SPF) development started in 2003; DomainKeys Identified Mail (DKIM), was formalized in 2007; while the Domain-based Message Authentication, Reporting, and Conformance's (DMARC) development began in 2010 with its first public specification appeared in 2012.

Four email assessment areas - authentication, domain, sender relationship, and message content. The graphic notes that an email can pass authentication and still be malicious.

In a nutshell what we had were layers developed to help build trust and this worked for a while because it was partly too expensive for scammers to replicate or expose their true identity to meet these email authentication requirements. The authentication layer is where the email domain is verified as the source of the email being sent, so an email that says it is from user@microsoft.com would be verified that it was actually sent by a server authorized to send emails on behalf of domain microsoft.com.

Next we have the ownership layer where we determine who the verified domain is. Is this an organisation or individual that I can trust? Was this a brand new domain, does it have a website?

Next we have the relationship layer, is this the first time receiving an email from this sender or is there a contact history.

And last we have what I call the legitimacy layer where we look at the actual email's content. Is it asking the reader to click a link, offering money, is it requesting credentials, payment or was it an unsolicited invoice?

Before I continue, I want to clarify what I mean by being expensive for scammers. Sending mass emails from newly setup server and IP can be difficult because a new IP has little or no sending history, and sending a mass emails immediately can lead to being flagged as spam, throttling, or outright rejection while its reputation is established. So by using a mass mailer's network, scammers may be able to send through a configured infrastructure and shared IPs with an existing good reputation. They can authenticate disposable domains while relying on the provider’s network to handle the delivery. This I believe lowers the cost and time needed they would otherwise need.

So back to why I wrote this article. Back in August, I started receiving phishing emails that passed the authentication layer while I was able to identify issues at the other layers. The ownership and legitimacy failed, it was easy to spot as the email content was not something I opted for and there was no website for the main domain.

Here is an example of what that email said:

"Based on your business information, we can provide: Miguel Maloney up to $410,000 in unsecured capital to help unlock new opportunities.

Can I share the main terms in a simple summary?"

The email claimed to be sent by a Valerie who was offering a large unsecured loan. The chances of a stranger speaking to me about a loan in the first lines of the email especially without reference to what I am doing and what they want in return, was an obvious red flag, a scam. The first layer passed while the others failed.

Because the first layer passed with flying colors I had to find out how this was being done at scale because usually it is very expensive for scammers to set up and usually the risks to their identity being exposed. I also noticed how quickly they were adapting. For example replacing domains as soon as they are flagged and blocked, they were quickly setting up disposable domains.

Cropped email header showing SPF, DKIM, and DMARC results as “pass”; these results authenticate domains but do not establish that the message is legitimate.

So I took a closer look at the email header to identify what was being done under the hood.

I will skip the technical details to just say that after analysing the email header, I was able to identify a mass email sender's network that was being used to push these phishing emails. This was strange because usually when setting up an account with mass email sending platforms you have to go through a strict process and check some boxes.

And that was the problem, this scammer was checking those boxes. And it became clear to me that the rules we have been using for years have mostly now become myths and in some cases were not properly understood in the first place. For example:

  • DMARC passed, so the email is legit. Yes DMARC passed but the email was clearly a phishing email. DMARC only proves authentication, nothing else, many assumed that is a trust signal but it clearly is not.

  • The links used the sending domain, so the email is legitimate. A tracking link can use a subdomain while routing through an mass mailing's platform. That is normal for bulk emails so this would not prove a message is legitimate. In this case, inspecting the redirect showed that the link led to appfbnneed.org, which made me curious.

  • Having an unsubscribe link proves legitimacy. Yes there was an unsubscribe link, but it was just a trick to win trust.

  • It didn't ask for a password or other type of credential. Yes it didn't but instead it asked for a reply which is social engineering 101. Send thousands of emails and get hundreds of replies that helps the scammer to confirm additional details to do a more direct attacks.

So this showed that while the receiving email server’s authentication results showed SPF, DKIM, and DMARC passing. That means the message passed the authentication layer checks; it did not establish that the sender is trustworthy or the message is legitimate. We have to look at the other layers before deciding if an email is legit or not. This means that anti-spam solutions need to have checks that go beyond just verifying authentication which some more recent ones actually do.

Some things that can help to clarify everything.

First, never click a link in an email that you suspect to be a scam including the unsubscribe link.

  • Common sense. Persons who provide loans do not cold approach strangers with a $410K offer, especially without that person sending an application, there first being a relationship, or without any reference being made to the purpose of the loan.

  • Social engineering. "Can I share the main terms in a simple summary?" is a clever way to get a "yes" or even a "no" reply which would confirm an active email, confirmed person for that email and possibly more information about that person they did not know before. You may be quick to say that no one would ever reply but I have known persons who have done so even with their suspicions that they got a phishing email. But there is something about human nature that causes us to always want to explore risky situations and scammers know this and have been leveraging on that human nature.

  • Possible merge-field variables being used. For example "Hey Miguel, We're helping businesses like Miguel Maloney up to $410,000". Here we see my name repeated which does not sound natural. It could suggest that the scammer only has my name and not a business so they repeated my full name which could suggest the use of merge-field variables to mass mail these to a set of emails and names from a data breach or purchased list as an initial step in social engineering to see what other information can be collected from the few who will reply.

  • Domain age. Many anti-spam solutions detect this. We should remember this is just a signal and not a confirmation and should therefore be combined with other checks to paint the big picture.

  • The actual domain name, was it random characters generated or a domain name that represent the type of business it claims to be? Another crack in the scammer's armour. It is very expensive to "dot" all the "i's" and cross every "t's" so usually a bulk pattern registration for disposable domains would be seen.

  • A functioning website. When I checked domains appfbnneed.org, consultingallfbne.org, nanofbnneed.com, and teamfbnemail.com back in August when I got those phishing emails, trying to access those websites timed out as there were no websites for those domains. That alone does not prove the emails were phishing since some legitimate organizations use email-only domains. But the repeated “fbn” string and the lack of a working website added to my concern when considered alongside the unsolicited loan offer and the other signals.

  • Some email links have a time-based Universally Unique Identifiers (UUID) that can roughly reveal when the link token was created. This is a bit technical and would be useful to analysts or anyone who is investigating flagged emails. The token that appears much older than an urgent email alert could be worth looking into, but it could also have been created during a legitimate email campaign setup. So the timestamp is a timeline clue, not proof of phishing; but it can be assessed along with the sender domain, destination link, and other evidence.

  • The tracking subdomain. Another signal and in this case one of the stronger ones. For example a subdomain of the sender's own domain would resolves to the hostname that belongs to the mass mailer's platform. So the unsubscribe link in the phishing email would point to something like track.senderdomain.com. The CNAME lookup using a tool like MxToolBox on that subdomain would resolve a hostname that belongs to the mass email platform, not the main domain of the subdomain.

The tracking subdomain. The unsubscribe link used for example inst.successfbnbiz.org, which resolved via CNAME to the domain of the mass email platform. Mass email services usually use tracking domains like this, so the CNAME alone is not proof of a phishing email. Here, it helped me identify the platform that the scammers were using for their legitimate-platform abuse. The link’s final destination and the other signals would be needed to ultimately decide if this email was suspicious, which in this case was.

Remember to combine your results, never conclude based on one result because an unsolicited email could be sent by someone who is not a scammer but if we have an unsolicited email that offers money and has your name repeated or your email address used like your name, and other results from using tools like MxToolBox, those combined could suggest your are dealing with a scam email.

So what is the big take away of my article? Scammers also leverage various deliverability platforms that offer fast setups for sending mass emails, especially those that provide a limited free account that can be set up on the fly. Based on the frequency of the phishing emails I was getting, especially with so many disposable domains appearing so fast, I suspect the mass mailing platform being abused here uses AI to do their onboarding from what I saw in their promotion on their main website, which I believe eliminates setup friction and usually could also mean limited or no human review, allowing scammers to easily setup their disposable domains without any human review. This is what's called legitimate-platform abuse.

This could affect the deliverability of users of the same mass mailing service provider, who are not sending scam emails, especially if the sending domains or IPs get flagged or blocked.

In this case I have flagged and sent to the service provider to make them aware and hopefully they take steps to reduce this abuse. This is something that you could also do if you come across a situation like this, reporting through that mass mailer's platform channels and also reportphishing@apwg.org which is an anti-phishing organisation may help with getting the domain or IPs on blocklists by eCrime eXchange.

Both mass mailing providers and customers of those services should be aware of how scammers seek to leverage the very tools and frameworks aimed at fighting phishing and scam emails.

Mass email providers should prioritize account verification and ongoing abuse monitoring, including human review where necessary, over minimizing signup friction.

I hope this helps to shed some light on what scammers are doing and that it can help those who were not aware on how to detect them and what to do if you presently do not have a service or tool that goes beyond just verifying email authentication.

References for further reading: