Most phishing is loud. The same message goes to thousands of addresses in an afternoon, and that breadth is what gives it away. This campaign was quiet. Between late September and late October one mailbox at one customer received nineteen copies of a "secure document" notice, from eight different sending domains, never more than a couple a week. Every copy was held. It still taught us two things.
What the message looked like
The notices claimed to come from a US state licensing agency (Michigan's Department of Licensing and Regulatory Affairs, which the senders had no connection to) and told the recipient that a document relating to their license was waiting. The attachment, named something like Secure_Document.html, was a small web page. Opened in a browser, it showed a Microsoft-style sign-in form over a blurred document. Anything typed into it was posted to a bot on a chat service, from where the operator collected it.
Two details made it work as well as it did. The sending addresses rotated through real but unrelated domains, so no single sender built up a bad history. And the attachment was declared to the mail system not as a web page but as generic binary data, the type a mail server uses when it does not know what a file is.
Why it was held anyway
The copies scored far above the quarantine threshold from the first one. First contact from an unknown domain, a government agency named in the display name of a sender who was not that agency, urgency language, a credential-harvesting lure, and from the fourth copy onward a sender reputation that was already poor. None of the nineteen reached the inbox.
The two gaps
1. The attachment analyzer never opened the file
OpenEFA inspects HTML attachments for exactly this: login forms, scripts that post to unexpected places, hidden content. But it chose which attachments to inspect by their declared type, and these were declared as binary data. The analyzer that would have found the credential form never ran. The message was held on other evidence, which is the point of scoring many signals, but a kit that varied its other signals could have slipped past.
Fixed: any attachment with an HTML-style name whose bytes look like a web page is now inspected, whatever type the sender declared. Genuine secure-message envelopes that banks send as HTML attachments are unaffected: they come from authenticated senders with a delivery history at your organization, and the analyzer treats that history as the deciding factor.
2. It never looked like a campaign
Campaign detection fingerprints templates, link sets and attachment names and looks for the same fingerprint across many recipients or many organizations. This operator sent to one person, slowly. Nineteen copies over five weeks never crossed the breadth that campaign detection required, so each copy was judged on its own.
Fixed: a new detection tier watches for the same fingerprint reaching the same recipient or the same organization three or more times in thirty days from two or more sender domains. It is built for exactly this shape: one target, rotating senders, patience. In a thirty-day replay it found 171 such clusters, all of them spam.
What to tell your users
- A "secure document" that arrives as an attached web page is almost never genuine. Real document services send a link to their own site, and legitimate secure-message envelopes come from your bank's known address, not from a stranger.
- A sign-in form that opens from a file on your computer is a phishing page. Microsoft, Google and your bank never ask you to sign in to a page you downloaded. Check the address bar: a file path, not a website, is the tell.
- A government agency writing to your work address about a license you may hold is worth a phone call to the agency's published number before anything else.
- If anyone typed credentials into one of these pages, change the password now, revoke active sessions, and tell whoever manages your mail. The operator collects credentials in real time.
We publish these notes because the interesting part is not that the mail was held. It is that a careful attacker found two assumptions in the system, that attachment types are declared honestly and that campaigns are wide, and that the fixes are now part of the service for everyone. The full list of changes is on the What's New page.