Cobalt Strike "Beacon"

via ironbranchhq.onmicrosoft.com  clearly an inside job, how do you think this company's like Google, Facebook Twitter and Microsoft make millions wake up people!

No name was inserted. Just "support@my actual email domain.com" in the from address field. No malware was detected on my PC and laptop by Norton. The message text spoof was fairly obvious. What surprised me was the inclusion of my email domain in the from address.

Baby-it's-cold-outside,

Spoofing the from address field in messages is no more difficult than any other field including the text, since their messages are most often sent from severs that aren't connected with any major email service, so the email services they use are specifically designed not to follow the technical validation and other requirements that the normal services do.

Putting your own address in the From field is the more common method, they just took this a step further and used the "support" name instead to make it seem more official, which you can see from your own surprise had precisely the psychological effect they had intended.

I spent several years making similar messages for organizations to perform phishing tests on their employees and there are literally an unlimited number of such mental tricks that can be used on the average person, since few look at messages with the same critical eye as someone like myself. The message that began this thread has literally dozens of red flags, but only a tiny handful of people can actually recognize them.

Rob

No name was inserted. Just "support@my actual email domain.com" in the from address field. No malware was detected on my PC and laptop by Norton. The message text spoof was fairly obvious. What surprised me was the inclusion of my email domain in the from address.