Spear phishers use fake email threads, fake SPF authentication

I work with people who are trying to prevent others from impersonating their domains. Usually this is preventative, but unfortunately, sometimes my work is reactive — ensuring that impersonation does not happen again.

One of the most common impersonation attacks is phishing, where hackers send emails to people hoping to get them to reveal a password, grant access to an account, turn over personal information, or even transfer money. It’s not surprising that companies are starting to see more examples of successful phishing and its more targeted variant, spear phishing. We’re seeing more and more press coverage of prominent spear phishing attacks and almost daily examples where it has been successful. As a result, some companies are starting to become more vigilant and scrutinize emails more closely. This, of course, means that the scammers are becoming more creative and are putting more effort into making their emails seem legitimate. It’s a classic security arms race.

I spoke with a company that had recently been the victim of a spear phishing attack, to the tune of tens of thousands of dollars. The phishing email was very believable and the scammers had clearly done their homework. Here is what appears to have happened:

Step One: Infiltration

The scammers were able to compromise the corporate email account of an employee of the company. That seems to have been done using a fake G Suite link.

Step Two: Studying the Target

Once they had compromised that account, the scammers examined the history of emails between this user and the CEO to get a feel for the way the CEO wrote and the tone of his emails.

Step Three: The Fake Email Thread

With this information, they crafted an email that appeared like it was part of an existing email thread in which people were already discussing some money to be wired to an account. In other words, the fraudsters faked an entire thread where actual people in the company appeared to be discussing a wire transfer. The person to whom it was addressed saw what looked like a string of emails discussing the wire transfer, followed by the request (to the recipient) to transfer the money. The faked thread made the request much more believable, since it did not seem to be an out of the blue request (although out-of-the-blue wire transfer requests can work too, sadly).

Step Four: Fake Authentication

The scammers did not stop there, however. They also made sure that the email passed SPF authentication. They did this by registering a domain that looked like the legitimate domain and set up an SPF record for the look-alike domain. They then used this new (fake) domain in the email’s Return-path header (which is what SPF checks), while using the company’s actual domain in the From: address that appears to the recipient. This ensured that even if the recipient were to look at the email headers, the message would appear legitimate thanks to the presence of SPF authentication there.

Step Five: The Heist

This was a lot of preparation on behalf of the scammers, but their efforts paid off. The targeted person received the email, believed it was legitimate, and transferred a large sum of money to the fraudulent account.

If the domain had been protected by DMARC enforcement, the scammers might still have been able to compromise the first employee’s email account, but they would not have been able to send the ultimate phishing email, because a DMARC check would have noted the mismatch between the From and Return-path headers, causing it to fail DMARC. As a result, the email would have been flagged as spam (or rejected outright, depending on the company’s DMARC policy), and the customer would not be out tens of thousands of dollars.