Discussion

We recently see a wave of salary adjustment #Phishing

While they are not breathtakingly new and brilliant they use several different technics. Some of which exploited interesting aspect I'd like to share.

First, they used a tempting-sounding subject line like:

Payment Docs
Document Review Ѕаlаrу
Salary Adjustment Notification

and (at least some) a very long Sender name or address, hiding the sender domain

Screenshot of an email header with the subject:
Salary Adjustment Notification Tuesday, December

and a very long sender address
The recipient address is obfuscated — Screenshot of an email header with the subject: Salary Adjustment Notification Tuesday, December and a very long sender address The recipient address is obfuscated

Screenshot of an email header with the subject:
Payment Docs EnabIed-lD: December 11, 2025 refID: ...

and a very long sender address
Support_Management_No-Reply|teams.microsoft.com/l/meetup-join/...

The recipient is obfuscated — Screenshot of an email header with the subject: Payment Docs EnabIed-lD: December 11, 2025 refID: ... and a very long sender address Support_Management_No-Reply|teams.microsoft.com/l/meetup-join/... The recipient is obfuscated

Screenshot of an email header with the subject
####Document Review Ѕаlаrу NOV 2025

and a very long sender name starting with
Administrative/HR:Employee Development and Salary Adjustm...

Some email addresses are obfuscated — Screenshot of an email header with the subject ####Document Review Ѕаlаrу NOV 2025 and a very long sender name starting with Administrative/HR:Employee Development and Salary Adjustm... Some email addresses are obfuscated

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

Nothing spectacular here

Two of these attacks were empty messages containing a branded PDF.

The PDFs contained very appreciative messages:

Examples:
"We are pleased to inform you that, effective 01 January 2026, your base salary will be adjusted. This adjustment recognizes your valuable contributions to the company and reflects our commitment to maintaining fair, market-aligned compensation."

"Thank you for your hard work and continued commitment. Your dedication has not gone unnoticed, and as a reflection of your contributions, we’re pleased to acknowledge this with a salary increment. Your efforts truly make a difference, and we’re excited to move forward into a new month with fresh goals, continued teamwork, and shared success"

Sidenote: I think many HR departments could learn from the wording used.

Follow by the instructions to review this through the include QR code and to keep the message confidential.

Sidenote: Secrecy is a common technic used by attackers to increase the success rate. A review by a second pair of eyes would improve the chance to encounter a "Wait, this looks too good to be true" revelation.

The QR code was split into two images to hide it from content filters. They would need to stich the images correctly before they could detect the URL hidden in the QR code

The green bar stating that "E-mail was scanned by mail security and is believed to be clean." is also a nice psychological touch. What could possibly go wrong if the email was checked by security 😬

#Phishing

Screenshot of a PDF

Green Bar: E-mail was scanned by mail security and is believed to be clean.

Please Scan the QR code to review

[Obfuscated QR Code]

Dear XXX,

We are pleased to inform you that, effective 01 January 2026, your base salary will be adjusted. This adjustment recognizes your valuable contributions to the company and reflects our commitment to maintaining fair, market-aligned compensation.

To review the details of your updated salary, please scan the QR code provided.

Confidentiality Notice: This information is strictly confidential and must not be disclosed or discussed with colleagues or external parties.

Thank you for your continued dedication and excellent work.

This notice serves as confirmation of our agreement moving forward.

We look forward to achieving new goals together with the same spirit of collaboration and commitment that has always defined our partnership.

Best regards, — Screenshot of a PDF Green Bar: E-mail was scanned by mail security and is believed to be clean. Please Scan the QR code to review [Obfuscated QR Code] Dear XXX, We are pleased to inform you that, effective 01 January 2026, your base salary will be adjusted. This adjustment recognizes your valuable contributions to the company and reflects our commitment to maintaining fair, market-aligned compensation. To review the details of your updated salary, please scan the QR code provided. Confidentiality Notice: This information is strictly confidential and must not be disclosed or discussed with colleagues or external parties. Thank you for your continued dedication and excellent work. This notice serves as confirmation of our agreement moving forward. We look forward to achieving new goals together with the same spirit of collaboration and commitment that has always defined our partnership. Best regards,

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

The use of the QR code has another advantage for the attackers. While the targets received the email on their (hopefully) well protected company device. They will quit likely use their (private) mobile phone to scan the QR code

Which essentially circumvents all enterprise security measures

#Phishing

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

Checking the PDF properties reveals some other suspicious details:

PDF creator: wkhtmltopdf 0.12.6
PDF producer: Qt 4.8.7

wkhtmltopdf is command line tools to render HTML into PDF using the QT Webkit rendering engine.

Which would be a strange tool for typical HR systems creating these kinds of messages.

The identical PDF creator suggests that, if it's not the same group behind the attacks, they at least seem to use the same tooling.

#Phishing

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

There is also another type of attack.

A fake personalised #docusign request.
Deviously the email seem to contain text. In reality it's an image with a link.

I didn't realise this and accidentally opened the link.

Sidenote: Even being a security expert and being very aware that you are handling malicious data doesn't protect you from mistakes.

The system isolation blocked the web request. So, no harm done.

Sidenote: Simply opening a link is very unlikely to cause damage on a system with current patches installed. But it might inform the attackers that your email is in use, making your information/email address more valuable.

An image looking like a docusign request

You have a pending document that requires your signature

ACCESS PENDING DOCUMENT

[obfuscated]

2025 Q4 payments, End of the year bonus and Employee benefit agreement.
All parties need to complete with DocuSign: Payment application & approval process.pdf

To review and electronically sign the payment document, proceed to click on "ACCESS PENDING DOCUMENT" and use the secured link to append your signature.

Powered by docusign

Do Not Share This Email
This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others.

Alternate Signing Method
Visit DocuSign.com, click 'Access Documents', and enter the security code:
312D20FE4FDA4639ADE2D47F39BD4EED4

About Docu Sign
Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- DocuSign provides a professional trusted solution for Digital Transaction Management™.

... — An image looking like a docusign request You have a pending document that requires your signature ACCESS PENDING DOCUMENT [obfuscated] 2025 Q4 payments, End of the year bonus and Employee benefit agreement. All parties need to complete with DocuSign: Payment application & approval process.pdf To review and electronically sign the payment document, proceed to click on "ACCESS PENDING DOCUMENT" and use the secured link to append your signature. Powered by docusign Do Not Share This Email This email contains a secure link to DocuSign. Please do not share this email, link, or access code with others. Alternate Signing Method Visit DocuSign.com, click 'Access Documents', and enter the security code: 312D20FE4FDA4639ADE2D47F39BD4EED4 About Docu Sign Sign documents electronically in just minutes. It's safe, secure, and legally binding. Whether you're in an office, at home, on-the-go -- or even across the globe -- DocuSign provides a professional trusted solution for Digital Transaction Management™. ...

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

Last but not least
What is the goal of the attacks?

After several redirects the link I checked lead to fake Microsoft login pages.
This is especially dangerous as these sites can circumvent multi factor authentication (at least if you do it via a authenticator app or similar)

When you enter your credentials the malicious site tries to directly authenticator itself again your Microsoft account. This triggers an authentication request if a second factor is configured. As you are authenticating yourself you confirm the second factor. Which the attackers use in the background to get access to your company account on Azure

Screenshot of a Microsoft login page. In the movie address bar at the bottom it's visible that it isn't a valid Microsoft URL

Claudius Link

@realn2s@infosec.exchange replied · 2 weeks ago

As mentioned in the first post the #Phishing use a very long sender to hide the sender domain.

But how the senders are structured is also intentional to play tricks on our brain in two different ways:

The senders pretend to be from HR (matching the expectations).

The senders contain a "noreply" priming us for non-human email address

Some of the senders used an additional trick.
Their from-addresses look like a team meeting link. Triggering our pattern recognition and tricking our brain into thinking "I know what this is. Therefore, I don't need to think about it"

It might surprise you but the local part of an email address (the stuff before the @) can be basically anything (including case sensitive)

More here https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/

Screenshot of an emaol from address reading

Support_Management_No-Reply|teams.microsoft.com/l/meetup-join/19%3ameeting_Y2Q5NjAwMDgtMWQ0Zi00OGY2LWE5YzktNzUyOGIxOTFhYzlk%40thread.v2/0?context=%7b%22Tid%22%3a%2267ae327d-8b3d-454b-862b-316c4c64cefb%22%2c%22Oid%22%3a%22ea1d9305-9c68-405c-85d4-1595f816f3f0%22%7d-sam.ripley@stonewells.net — Screenshot of an emaol from address reading Support_Management_No-Reply|teams.microsoft.com/l/meetup-join/19%3ameeting_Y2Q5NjAwMDgtMWQ0Zi00OGY2LWE5YzktNzUyOGIxOTFhYzlk%40thread.v2/0?context=%7b%22Tid%22%3a%2267ae327d-8b3d-454b-862b-316c4c64cefb%22%2c%22Oid%22%3a%22ea1d9305-9c68-405c-85d4-1595f816f3f0%22%7d-sam.ripley@stonewells.net

Screenshot of an email from address reding

HR noreply - <hr.dept-qhkzvnbjgkwouckdohajuzrggujcshnnmzidhkioaffamnbognlarxojpwoiewezodwhejmmcaabjnxw@bdlwc.net> — Screenshot of an email from address reding HR noreply - <hr.dept-qhkzvnbjgkwouckdohajuzrggujcshnnmzidhkioaffamnbognlarxojpwoiewezodwhejmmcaabjnxw@bdlwc.net>

1 more replies (not shown)

bonfire.cafe

A space for Bonfire maintainers and contributors to communicate

bonfire.cafe: About · Code of conduct · Privacy · Users · Instances

Bonfire social · 1.0.1-alpha.40 no JS en

Automatic federation enabled