Armorblox researchers uncovered a new phishing campaign that is targeting American Express customers. The messages use a malicious attachment and their content attempt to trick cardholders into opening it.
The subject of the emails reads “Important Notification About Your Account” in an attempt to urge recipients to open it. Once opened, the email appears as a legitimate email communication from American Express, while the content instructs the cardholder on how to view the secure, encrypted message attached.
Upon clicking on the link in the message, victims are redirected to a fake American Express login page, which includes the company’s logo and a link to download the American Express app.
The phishing campaign bypassed native Google Workspace email security controls because it passed both DKIM and SPF email authentication.
Threat actors behind the campaign used a valid domain to send this malicious email, the domain used by the sender received a reputation score of trustworthy and global threat history of zero security events. The phishing email, marked by Google as safe, was delivered to more than 16,000 users’ addresses.
