Detect Hijacked Email Accounts With Extreme Open-Rate Anomalies
Summary
The article describes how attackers can replay a DKIM-signed email from a hijacked account, causing tracking events to spike. It recommends alerting on single-message open rates above 1,000% and investigating account activity.
Key points
- The author reports observing hijacked accounts whose single messages generated tens of thousands of opens and clicks, far exceeding the account’s recorded send volume.
- In the described DKIM replay, an attacker sends one authenticated message, then replays it to many recipients; SPF, DKIM, and DMARC passing does not establish that the account user was authorized.
- Replayed messages can retain the original tracking pixel and wrapped URLs, causing events from many recipients to accumulate under one message ID.
- The proposed alert triggers when a sender has more than a 1,000% open rate on a single message; investigation includes checking login IP history and comparing the message with the account’s send volume.
- Platforms serving many senders should monitor these anomalies centrally, since a compromised account can put shared sending infrastructure and its reputation at risk.
- Response steps include rotating credentials and, where applicable, disabling wrapped URLs. These steps cannot retract messages already delivered or undo clicks that have already occurred.
- Open-rate data can be distorted by repeated opens and security scanners, so it is useful as a security signal but should not be treated as a definitive measure of human engagement.
Article Details
- Defense Focus
- Detect hijacked email accounts and DKIM replay by treating extreme per-message engagement as security telemetry.
- Detection Methods
- Alert when a single message exceeds a 1,000% open rate.
- Compare the anomalous message ID's opens and clicks with the account's declared send volume.
- Review account login IP history and investigate sessions originating from unfamiliar geographies.
- Monitor engagement metrics at the sending-platform level across user accounts.
- Data Sources
- Email tracking data for opens and clicks
- Per-message IDs and account send-volume records
- Account login IP history and session geography
- Rule Types
- Single-message open-rate threshold alert
- Platforms
- Email sending platforms with link-wrapping and engagement tracking
- Defensive Actions
- Automate alerts and investigate anomalies promptly rather than waiting for periodic reviews.
- Check login history and compare anomalous message activity with the account's send volume.
- Rotate compromised account credentials.
- On platforms using CNAME-wrapped links, disable the wrapped URLs to stop them resolving.
- Maintain a platform-level monitoring runbook for impossible engagement anomalies.
MITRE ATT&CK
People
Mario NascimentoIn a discussion cited by the article, he identified a compromised tool or OAuth token, rather than spoofing, as the most likely root cause.Matt SantillIn a discussion cited by the article, he characterized fraudulent mail that passes authentication as authenticated abuse rather than authentication failure.Trevor HatfieldIn a discussion cited by the article, he described the underlying issue as a gap in upstream access controls when authenticated email is fraudulent.
Countries
Indiais what makes the signal so clean. They logged in — the IP history almost always pointed to Russia, India, or Romania — sent a single message, and disappeared. No repeated sends, no lingering session, no gradualRomaniamakes the signal so clean. They logged in — the IP history almost always pointed to Russia, India, or Romania — sent a single message, and disappeared. No repeated sends, no lingering session, no gradual ramp. OneRussiashowed is what makes the signal so clean. They logged in — the IP history almost always pointed to Russia, India, or Romania — sent a single message, and disappeared. No repeated sends, no lingering session, no