Trusted Services As Phishing Vectors: Techniques, Evasion, And Defensive Controls

Threat Overview

Attackers increasingly leverage legitimate mail-sending infrastructure, either by compromising accounts, abusing third-party services, or spoofing subdomains, to deliver phishing emails that appear authentic. These methods boost deliverability, credibility, and success rates.

Common Techniques Used by Attackers

Rather than blatantly impersonating a brand, attackers often use legitimate mail‑sending infrastructure or make the message look like it came from such infrastructure. That gives the email better deliverability and credibility. There are three common variants:

1. Compromised Sending Account:
   A malicious actor gains access to a bona fide bulk‑mailing account (e.g., an org’s Mailgun, SendGrid, or corporate notification system) and sends phishing content from an otherwise reputable sender.
2. Abuse of Third‑party Services:
   Attackers register or exploit third‑party transactional email services (or free tiers) to send high‑volume messages that appear to be from a trusted service domain or subdomain.
3. Spoofing & Subdomain Trickery:
   The attacker forges headers (From, Reply‑To, Return‑Path) or uses look‑alike subdomains (e.g., notify.example‑mail.com or em123.example.com) to mimic legitimate traffic. They may also chain redirects so a seemingly safe link first goes to the sending service, then to a phishing page.

All three increase the chance the email reaches an inbox and that the recipient trusts it enough to click a link or open an attachment.

Technical Analysis

• Typical Attacker TTPs
  • Return‑path / bounce addresses that don’t match the brand (e.g., bounces+random@some-subdomain.example.com).
  • Subdomain impersonation using long or plausible subdomains that look official at a glance.
  • Randomized subjects or GUIDs to bypass simple pattern‑based rules.
  • High deliverability indicators: messages coming from well‑known mail infrastructures.
  • Attachments in unusual containers: password‑protected ZIPs, macro-enabled Office files (.docm, .xlsm) or nested archives.
  • Low interactivity user targeting: business addresses or internal-looking recipients that lower suspicion.
• Why These Attacks Evade Detection
  • Many filters weight sender reputation and IP history legitimate services or newly registered but clean-looking domains can have good scores.
  • Subdomain and header tricks can make automated parsing believe the mail is first-party or transactional.
  • Users are trained to trust “system” emails (invoices, task notifications, document shares), so social engineering succeeds more often.
  • Subtle Return‑Path or Subdomain Manipulation: Even if DMARC, DKIM, or SPF are configured, attackers can exploit subdomains or alternate sending addresses to bypass checks.
• Common Failure Modes and Attacker Techniques
• Envelope / Return‑Path ≠ Header From
  • What happens: The visible From: header shows a trusted brand, but the SMTP MAIL FROM (Return‑Path) points to a different domain or subdomain the attacker controls.
  • Why attackers do it: This lets the message display a legitimate sender while routing delivery checks (SPF) against an attacker‑controlled envelope.
  • What it enables: Higher inbox placement with a plausible display identity while retaining direct control over bounce handling and reputation.
• Subdomain Delegation & Shadowing
  • What happens: Attackers exploit weak subdomain policies or use delegated subdomains (e.g., em123.brand.example) to host mail or pages.
  • Why attackers do it: Subdomains look official to users but can be easier to register, compromise, or use via third-party services.
  • What it enables: Convincing sender addresses and hosting for phishing pages that inherit visual trust from the parent brand.
• Compromised or Abused ESP Accounts
  • What happens: Adversaries send mail through legitimate Email Service Providers (ESPs) like Mailgun, SendGrid, or SES using verified subdomains or stolen API keys.
  • Why attackers do it: ESPs provide excellent deliverability, DKIM signing, and reputable IP ranges everything attackers want to get past filters.
  • What it enables: Large-scale, high-deliverability campaigns that often pass basic reputation checks and reach inboxes at scale.
• DKIM Present but Not Aligned with Visible Sender
  • What happens: Messages carry valid DKIM signatures, but the signing domain (d=) differs from the displayed From: domain, so DMARC alignment fails.
  • Why attackers do it: A signed message looks legitimate to some systems and users, yet cryptographic alignment to the visible sender is missing or weak.
  • What it enables: Situations where automated triage tools are confused by the presence of a signature, and human reviewers assume authenticity.
• Forwarding and Mail Flow Breaking SPF
  • What happens: Legitimate forwarding rewrites the delivery path so the forwarder’s IP is not authorized in the original sender’s SPF.
  • Why attackers exploit it: Forwarding can create false negatives or inconclusive authentication results without ARC, letting malicious mail hide in normal flows.
  • What it enables: Reduced signal fidelity for authentication, enabling malicious messages to blend into legitimate routing artifacts.
• Open Redirectors and Chained Redirects
  • What happens: Links in mail point to a reputable domain that immediately redirects to a short-lived phishing site.
  • Why attackers do it: Trusted intermediaries mask the true destination and slow down reputation systems.
  • What it enables: Higher click-through rates and longer campaign lifetimes because the final landing is shielded behind high-reputation infrastructure.

MITRE ATT&CK Mapping

• Relevant techniques include:
  • T1566.002: Phishing: Spearphishing Link
  • T1584: Compromise Infrastructure
  • T1583.006: Acquire Infrastructure: Web Services
  • T1606: Forge Web Credentials
  • T1587.003: evelop Capabilities: Digital Certificates
  • T1588.002: Obtain Capabilities: Tooling

Impacted Technologies

• Microsoft 365 & Exchange Online
• Email Service Providers (Mailgun, SendGrid, SES)
• Defender for Office 365
• Microsoft Defender XDR (Email & Collaboration)
• Microsoft Sentinel (email log analysis)

Detection

• Effective detection for these campaigns relies on identifying identity drift, subtle authentication gaps, and behavioral anomalies within mail flows. Strong signals include:
  • Header & Identity Misalignment Detection
    Flag emails where the visible From, Return-Path, DKIM d= domain, and SPF-authenticated sender do not align as expected. Even slight domain drift or unusual subdomain patterns should elevate the score.
  • Behavioral Analysis of Sender Reputation
    Track changes in domain behavior over time. Sudden shifts in volume, sending patterns, or reputation, especially from delegated subdomains or ESP senders, are strong indicators of potential abuse.
  • Detection of Redirect Chains & Link Behavior
    Inspect URLs for open redirects, multi-stage redirects, or short-lived final destinations hosted on newly registered domains.
  • Routing Path Anomalies
    Abnormal MAIL FROM / Received-chain patterns (e.g., inconsistent relay hops, unexpected ESP signatures) indicate potential spoofing or abuse of third-party mail infrastructure.
  • ESP Abuse Indicators
    Look for legitimate ESP identifiers (Mailgun, SendGrid, SES) being used in unusual contexts, such as new subdomains, rare tenants, or inconsistent signing keys.
  • New Domain & Look-alike Domain Monitoring
    Detect messages sent from domains that closely resemble the organization’s brand or internal subdomains, especially if newly registered.

Prevention

• Enforce strict alignment in DMARC.
• Limit or monitor delegated subdomains.
• Restrict who can create or verify sending domains in ESPs.
• Disable open redirectors on corporate services.
• Educate users on subtle phishing indicators (Return-Path mismatch, suspicious subdomains).

Phishing has evolved far beyond clumsy fake invoices and misspelled URLs. Today’s campaigns operate in the gray space between trusted and malicious where legitimate infrastructure, compromised accounts, and well-crafted subdomains blur the line between safe and suspicious. Attackers are no longer just spoofing brands; they’re hijacking the very systems designed to deliver authentic communication.

What makes this threat so effective is subtlety. When a message originates from a known ESP, carries a valid DKIM signature, and passes SPF checks, even seasoned users and automated filters can be deceived. These emails don’t rely on loud social engineering they rely on quiet credibility. Each small misconfiguration or loosely enforced policy becomes an entry point for deception.

Defending against this kind of abuse requires more than reactive filtering. It demands visibility into sender behaviour, alignment between authentication layers, and continuous refinement of how organizations manage their mail-sending identities. The goal isn’t just to block malicious emails it’s to understand how legitimate ones can be weaponized.

By strengthening authentication, tightening subdomain control, and pairing that with intelligent detection, organizations can reclaim trust in their communication channels. Because when trust itself becomes the target, defense has to begin at the protocol level and extend all the way to user awareness.

These campaigns succeed not because they are flashy, but because they are subtle. Attackers are hijacking trusted services, the very systems users rely on every day. When a phishing email is sent through a reputable ESP, signed with DKIM, and passes SPF, even experienced users and advanced filters can be deceived.

This increases the risk of:

• Credential theft
• Fraudulent transactions
• Business email compromise (BEC)
• Sensitive data loss
• Reputational damage
• Compliance or regulatory exposure

The threat demonstrates how legitimate infrastructure can be weaponized when authentication is misconfigured or subdomain controls are weak.

• Intelligence-Driven Detection
  The CSI team collects, analyzes, and enriches threat intelligence, from email headers, routing paths, and sender behavior to look-alike domains. This allows Wizard Cyber to detect subtle phishing campaigns that exploit trusted services before they reach end users.
• Actionable Security Advisories & Profiles
  CSI produces timely advisories, actor profiles, and customer-specific threat profiles. Wizard Cyber leverages these insights to guide organizations in hardening email authentication, closing gaps in SPF, DKIM, DMARC, and securing subdomains against misuse.
• Enhanced Monitoring & Reporting
  CSI continuously monitors emerging threats, suspicious domains, and phishing infrastructures. These outputs feed Wizard Cyber’s platforms to improve detection precision, enrich dashboards, and support training for SOC and threat-hunting teams.

In short, Wizard Cyber bridges the gap between prevention and detection. By combining protocol expertise, real-time behavioural analytics, and continuous threat intelligence, we help organizations stop phishing campaigns that abuse trusted infrastructure before they turn into breaches.