Phishing emails disguised as spam filter alerts are stealing logins

Phishing emails disguised as spam filter alerts are credential harvesting attempts that spoof internal “email delivery” notices and redirect victims to a fake login page, according to Malwarebytes. The campaigns feed a base64ised spoofed address to the phishing site, where the fake login screen already pre-fills the target’s domain to look convincing, and the site uses a websocket to harvest credentials in real time.

Researchers note that the attackers can prompt for additional information, such as two-factor codes, and that successful login could allow attackers to take control of email and cloud storage accounts. The domain mdbgo[.]io, cited as the real phishing site, was blocked by Malwarebytes, and Unit42 warned about this type of spam-filter spoofing, though Malwarebytes’ findings suggest the attack is evolving quickly and is more sophisticated than initially described.

To stay safe, users are urged to avoid unsolicited attachments, verify website addresses before signing in, and use updated security tools with web protection and MFA. Published on 12 November 2025.