Email Phishing Attacks Exploit No-Code Platforms, Bypassing Traditional Security Measures
A new wave of email phishing attacks is leveraging no-code application platforms to bypass traditional email security measures. Attackers are using these platforms' notification mailers to send fraudulent messages, such as fake legal notices, where the sender's email address, reply-to, return-path, and DKIM signing domain all legitimately belong to the platform. This technique makes it impossible for conventional security controls, which rely on blocking suspicious senders, to identify and stop the attacks. The phishing emails appear authentic because they originate from trusted platforms, even though the content is malicious. One example involved a fake intellectual property infringement notice, complete with a real law firm's letterhead, sent to a hotel's reservations mailbox.
