Phishing Operators Adopt New Tactics to Evade Detection
Recent trends in phishing attacks reveal a significant shift away from traditional methods that relied heavily on malware-laden attachments. Instead, phishing operators are increasingly utilizing trusted delivery services, authenticated domains, and sophisticated multi-stage URL cloaking techniques designed specifically to bypass conventional email security inspections.
The ongoing VBSpam comparative test has rigorously evaluated ten public full email-security products alongside one open-source solution against various categories of email streams, encompassing both wanted and unwanted messages as well as malicious content. This assessment adhered to the rigorous standards set by the Anti-Malware Testing Standards Organization (AMTSO), specifically referenced as AMTSO-LS1-TP207.
Among the modern, more stealthy phishing campaigns highlighted in the test, familiar hooks were observed, such as unpaid invoices, warnings about banking-consent updates, notifications of antivirus renewals, and subscription alerts. However, these campaigns have evolved to eliminate many of the indicators that traditional email security systems are most adept at detecting. This approach has made it exceedingly difficult for legacy controls to effectively guard against such threats.
Crucially, the malicious components of these campaigns are often not overtly presented as attachments or clear payloads. Instead, they reveal themselves only after victims have clicked through a complex series of redirects, undergone browser fingerprinting assessments, experienced hidden POST requests, and even encountered selectively served destination pages.
One notable Dutch-language phishing campaign impersonated well-known cybersecurity brands such as McAfee and TotalAV, misleading targets with claims that their devices had been infected with "631 dangerous viruses." This campaign effectively employed a sense of urgency surrounding an account-closure warning, coupled with an enticing offer of a 90% discount. The campaign successfully directed potential victims through a series of redirects utilizing tracking infrastructure, including IP addresses and domains like 31-59-175-195[.]syd[.]nbn[.]aussiebb[.]net, loadswage[.]com, and eightindigostove[.]com. Ultimately, the operation was characterized as a form of scareware or subscription fraud, aiming to extract payment information or affiliate revenue rather than deliver a conventional malware payload.
The intricacies of this campaign serve as a stark reminder of why relying solely on attachment-centric filtering is no longer adequate. The phishing email itself employed sophisticated HTML-only social engineering techniques, featured a seemingly legitimate sender domain, and included separate tracking and unsubscribe links. Furthermore, the dynamic nature of its infrastructure meant that the final destination could change based on the time, location, or profile of the victim.
A mere scanner that evaluates only the original email or conducts simplified link detonation tests might only perceive what appears to be a legitimate commercial renewal notice, thereby critically underestimating the threat.
In another campaign dated August, an overdue payment reminder written in German was employed to disguise a Web3-related fraud objective. This email message was sent via Amazon’s Simple Email Service using a DKIM-aligned domain, namely moolaah[.]com, urging recipients to open a "Mahnschreiben" or payment reminder. Notably, the email did not contain any attachments, and its embedded URL led to a first-stage page characterized by decoy markup, hidden text, a zero-size iframe, and obfuscated JavaScript.
This particular webpage was engineered to gather browser and timezone signals prior to executing a concealed POST request, notably resolving to opensea[.]io during live analysis. The intricacies involved in such campaigns highlight how attackers are increasingly opting for cloaked routes instead of confirmed malware delivery, using social engineering tactics that leverage trust signals that organizations typically implement.
The findings from Virus Bulletin’s Q3 2026 VBSpam test indicate that even as leading email gateways maintain stellar catch rates, attackers are cleverly using browser-aware redirect chains to divert malicious activities away from the email itself.
Trusted Email Abuse and Security Risks
Furthermore, the chain of these attacks points directly to a stealthy exploitation of crypto or NFT fraud paths rather than simple malware deployment. The employment of authenticated senders, a clean transactional format, and a fingerprinting gate serve to illustrate how cybercriminals can abuse trust signals, which organizations often utilize to mitigate false positives.
In a related case, a phishing email in Romanian impersonated BCR S.A., asserting that a renewal of PSD2 consent was mandatory and threatening that online and mobile banking access would be restricted without immediate action. This particular email was sent from the DKIM-aligned but unrelated domain xmasbrick[.]com, embedding an IPv6-mapped address intended to obscure the true destination.
This kind of URL format complicates simplistic URL extraction and reputation checks while enabling attackers to deliver harmless content back to automated crawlers. The end goal of such a strategy likely revolves around credential theft, aided by localized regulatory language, authentic bank branding, and a sender path that appears trustworthy.
Despite the advanced techniques employed by these phishing operators, top-performing email security platforms have shown exceptional detection rates. Notable success was achieved by Net at Work’s NoSpamProxy, which ranked first with an astonishing 99.995 score. This was followed by Bitdefender GravityZone Premium and SEPPmail.cloudfilter, both of which also achieved exceptional results.
Conversely, the open-source Rspamd solution recorded a much lower performance, catching only 62.550% of phishing emails. These findings underscore the necessity for organizations to treat SPF, DKIM, and DMARC as controls for sender authentication, rather than presumptive proof of safety.
Email security defenses must evolve by normalizing obfuscated URLs, continuously monitoring and reassessing redirect chains, and detecting behavior associated with browser fingerprinting. It’s also essential for security teams to educate users on the importance of independently accessing banking and subscription services, rather than following links embedded within unsolicited messages.
The geographical distribution of observed spam during the test revealed that the majority of samples originated from U.S.-based IP addresses, accounting for approximately 67.54%, followed by China at 7.06% and Russia at 3.36%.
In conclusion, ongoing education and enhanced security measures remain critical as phishing operators adapt their tactics in increasingly sophisticated ways.