Phishing Emails Alert: How Spam Filters Can Steal Your Email Logins in an Instant

Cybercriminals are exploiting trust in internal security systems by spoofing email delivery notifications to resemble legitimate spam-filter alerts, aimed at stealing login credentials that could access email accounts, cloud storage and other sensitive systems.

According to Unit42, the campaign uses a professional-looking delivery report showing the target’s address and a structured status, prompting recipients to click a “Move to Inbox” button with a claim that messages will be delivered within one to two hours after confirmation.

The phishing flow redirects via cbssports[.]com to mask the real phishing site hosted on mdbgo[.]io, and the attackers harvest credentials through a fake login screen with the victim’s domain pre-populated, using heavily obfuscated code and websockets to exfiltrate data in real time. This enables credentials and two-factor codes to be captured the moment they are entered, allowing immediate access to accounts and impersonation across platforms.

Protection strategies emphasise never opening unsolicited attachments, verifying website addresses, using security tools to block phishing sites, and enabling multi-factor authentication and password managers.