Phishing Campaign Uses Unique UUIDs to Evade Secure Email Gateways

A sophisticated new phishing campaign discovered in early February 2025 is bypassing Secure Email Gateways and perimeter defenses through a mix of random domain selection, dynamic UUID generation, and browser session manipulation, according to Cofense Intelligence. The attack uses a dual UUID system, generating a hardcoded campaign UUID (6fafd0343-d771-4987-a760-25e5b31b44f) and a dynamically created session UUID to correlate exfiltrated credentials with specific victims while preserving campaign analytics.

It loads jQuery from a legitimate source and selects a single random .org domain from a hardcoded list of nine domains, reducing network traffic and evade typical multi-domain failover signals. The threat also employs server-driven dynamic deception by rewriting the webpage with server-provided content after an HTTPS POST containing the victim’s email and session UUID, aligning with MITRE ATT&CK framework T1185 (Browser Session Hijacking).

Delivery vectors include HTML-based email attachments and spoofed links impersonating trusted cloud platforms such as Microsoft OneDrive, SharePoint Online, DocuSign, Google Docs, and Adobe Sign. The campaign is described as an unprecedented capability for granular victim tracking while remaining operationally secure, and organisations are urged to review their email security controls beyond gateway filtering.