Huntress Explains Five Phishing Techniques and How to Spot Them
Summary
Huntress describes five phishing tactics—voicemail lures, callback scams, brand impersonation, fake shipping alerts, and trusted-site redirects—and recommends checking services directly, using MFA, filtering email, and reporting suspicious messages.
Key points
- Voicemail lures may use SVG attachments to redirect recipients to fake Microsoft login pages; the article identifies Raccoon0365 as the phishing kit used in one example.
- Callback phishing emails use fabricated payment or account problems to persuade recipients to call a scammer and disclose personal or financial information.
- Brand-impersonation messages may use misspelled sender names and open redirects from legitimate websites to reach fake login pages.
- Fake shipping notifications can include QR codes rendered with ASCII characters, which the article says may evade security tools.
- Living off Trusted Sites attacks route users through a legitimate service, such as Figma, before sending them to a fake login page; CAPTCHA services may be used along the way.
- Huntress recommends navigating directly to a service’s website instead of following email links, alongside email filtering, multifactor authentication, awareness training, and clear phishing-reporting processes.
Article Details
- Topic
- Five phishing techniques: voicemail lures, callback phishing, brand impersonation, fake shipping notifications, and Living off Trusted Sites
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bodasyestilo[.]com | Attacker-controlled domain hosting a fake Microsoft sign-in page in an open-redirect phishing attack. |
MITRE ATT&CK
Products
FigmaFor instance, the email below from prototyping tool Figma ([email protected]) tells recipients to “Review Funding” and directs them to the legitimate Figma website (figma.com).Microsoft 365 Apps for EnterpriseThe “Microsoft 365” email tells the target that their storage is full, and they need to “clear your cache in order to send and receive new emails.” Though the email header says the sender is “Microsof Teams Online”