Hackers Exploit Email Marketing Platforms to Deliver Hidden Malware

Hackers are increasingly exploiting legitimate email marketing platforms to deliver hidden malware, with Trustwave SpiderLabs observing a marked uptick in phishing campaigns that cloak malicious links behind these familiar services. By hijacking established infrastructure and URL redirectors, attackers evade traditional defenses and dupe recipients into divulging sensitive information, while Trustwave’s PageML system works to analyse URL structure and page content in real time to predict malign destinations.

The campaign specifics include Klaviyo’s click-tracking domain, klclick3[.]com, where phishing emails—often titled “New Voicemail”—redirect via ctrk.klclick3[.]com to a bespoke phishing page that uses Clearbit to fetch the victim’s company logo and disables right-click to hinder analysis, and Drip Global’s tracking domain dripemail2[.]com, which leads to a fake Microsoft Security page.

According to Report, only Trustwave’s scanning detected these malicious redirects in VirusTotal, underscoring PageML’s value in early threat identification. Beyond email platforms, threat actors have also abused cloud hosting endpoints such as Amazon S3 to host phishing pages that mimic Roundcube Webmail log-ins, complicating takedown efforts.