For all the research about Cybercrime and the techniques used by modern cybercriminals, one aspect has never changed. This pivotal point is the human element. Cybercriminals depend upon people who get their emails to scan them quickly and take action without looking for “proof” that the email is a scam. Here is an in-depth look at one such email.
Just in time for the end of the first quarter of 2025, the following email appeared in my inbox.
There are several details in this email which the cybercriminal is hoping we ignore. These are the items easily and most often missed:
- There is a warning from my email service that the sender’s shown name does not match the senders’ address
- This is a serious observation from the email system yet even with the warning triangle it often is ignored
- DocuSign does not add “Please treat this as Private” to their emails
- Finally there is the email address, and I do not know why Oil Tec of Egypt would be sending me this type of information without my asking
Next, I did an examination of the link by hovering over it and copying it to Notes to see what is inside.
Two things jumped out at me. First, why is Heinz a seriously good original product? Second, the website does not match the email sender’s address.
Next, I decided to have some “fun” and see how the email looks on a tablet.
So, this is quite different from my regular email client and raised my curiosity.
I decided to do the WRONG thing and click on the link. This action took me to:
Curiosity continues as this is not what looks like DocuSign at all! Again, the cybercriminal wants us to forget that they said it was DocuSign. Lately, in my reading, it’s been noted that some “dangerous” cybercriminals are doing real-time checking of the email address entered against what was sent in their email to avoid security researchers using tools to break the chain. In this example, that was not the case as ralphyboy@leaditconsulting.net worked for their checker. What happened next was the proof that they are seeking login credentials by presenting a fake Microsoft login page.
Again, take a moment to examine the URL of this web page to see that it is not even close to the portal for Microsoft which is https://portal.office.com. Below is what their link showed .(Yes it looks a bit different, and that is most likely due to their use of hidden characters.)
Summary
Modern cybercrime often relies on people being in too much of a rush, being behind schedule, and just not taking the moment to comprehend what the email is actually doing. These tactics have evolved to the point where the easiest spied emails are caught by modern-day tools. Therefore, those that do make it into your email inbox, like this one, are obtuse to many email safeguards.
Remember that Lead IT Consulting is here to help small businesses understand and navigate challenges in the IT landscape so your business can grow. We eat, live, and breathe navigating IT challenges daily to minimize risks and work for our clients. To find out more about how Lead IT Consulting can help your company with this and more book a meeting with the author or send an email to happiness@leaditconsulting.net.
