The Fake InfoSec Alert Hiding an Electricity Scam

An R&D team lead at a global IoT connectivity manufacturer opened a message that appeared to come from his own security team. The subject scolded him: links had been disabled, and a follow-up was required. The reflex that follows a note like that is to obey, not to interrogate the header.

The note was not from his security team. It came from a personal Gmail account with no connection to his employer, and everything it promised was a lie. Buried in the same subject line, dressed up in swapped characters to slip past filters, sat the real pitch: cut your electricity bill by ninety percent. Follow the one link the message offered and you did not land on a security portal. You landed on a Shopify storefront selling a power-saving gadget.

Two social-engineering hooks were stacked into a single line of text, and the delivery chain was engineered to look just legitimate enough to reach the inbox.

Two Lies in One Subject Line

The subject line did double duty. The first half read, to a scanner, like line noise: eIonlnventlon:Reductlon9O%onEIectrlclty. To a human it decodes to a promise about reducing electricity by ninety percent, reconstructed by the reader's brain despite the deliberate character substitutions. Capital I stands in for lowercase l, a zero replaces the letter O, and the spacing is collapsed. This is a classic evasion against exact-string content filters: the words electricity and reduction never appear in a form a keyword rule would match, but the eye reads them fine.

The second half borrowed authority that did not belong to the sender: an InfoSec notice framed as coming from the recipient's own organization, complete with a Links Disabled warning and a bracketed reference code. Impersonating an internal security team is a potent move precisely because it inverts suspicion. A message that claims to be the security team telling you about a problem feels like the last thing an attacker would send.

A Gmail Origin That Broke on Arrival

The authentication trail is where this case gets instructive. The message genuinely originated from Google infrastructure, so at the origin hop SPF passed, DKIM passed, and DMARC passed for gmail.com. Anyone reading only that first ARC result would see a clean bill of health.

It did not stay clean. The mail was relayed onward through an intermediary host that published no SPF, no DMARC, and no TXT records at all, a subdomain riding an otherwise legitimate healthcare-enrollment domain that had been pressed into service as a relay. By the time the message reached the recipient gateway, SPF had softfailed, DKIM had failed because the signature no longer verified, and DMARC failed outright with compauth=none reason=460. The sending IP behind that hop, 163[.]61[.]58[.]52, had no authorization to speak for anyone.

That split is the point. A phishing message can be born authenticated and arrive unauthenticated, and a gateway that trusts the friendly Gmail origin it sees quoted in an early header is trusting a signature that no longer applies to the message in front of it.

See Your Risk: Calculate how many threats your SEG is missing

Where the Link Actually Went

The message offered a single call to action, and it was wrapped. The visible link used a redirect wrapper that concealed the true destination, including a decoy noclick variant in the display text, hxxps://9dwbmu-kk.myshopify.noclick_com/, engineered to look inert while the live path resolved to a real storefront. That storefront was hxxps://9dwbmu-kk.myshopify[.]com/, a subdomain on Shopify's hosted commerce platform selling the electricity-reduction product the obfuscated subject line had teased.

There is no security portal anywhere in the chain. The Links Disabled framing was pure pretext to earn a click, and the redirect wrapper existed to keep static URL reputation checks from seeing a myshopify.com storefront until it was too late to matter. Hosting on a mainstream commerce platform gives the final page borrowed reputation for free, the same way the Gmail origin lent the message its initial polish.

Mapping to MITRE ATT&CK

The tradecraft lines up with a few techniques in the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery, a socially engineered message whose payload is a single wrapped link.
• T1036.005 Masquerading: Match Legitimate Name or Location covers the impersonation of the recipient's own internal InfoSec team.
• T1204.001 User Execution: Malicious Link covers the reliance on the recipient clicking the concealed destination.

Indicators of Compromise

Detection and What to Watch For

Nothing here is a signature a static gateway loves. There is no attachment and no malware, the origin authenticated on Google, and the final page sits on a platform millions of legitimate merchants use. Detection has to shift to behavior and intent: an external sender claiming an internal identity, a subject line whose characters do not match the words a human reads, and a lone call to action that routes through a wrapper before resolving to a commercial storefront.

That is where IRONSCALES adds a layer static filters miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, weighs the claimed internal identity against a first-time external Gmail sender and reads the redirect chain the way a trained analyst would, flagging the impersonation even when the earliest authentication hop looks clean. Pairing that with advanced malware and URL attack protection is what unwraps a concealed link before a user does.

The scale of the target set is why this matters. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and phishing in 15 percent, and clocks the median time to click a phishing link at 21 seconds and to hand over data at 28 seconds. The Microsoft Digital Defense Report 2024 documents the same shift toward abusing trusted services rather than breaking them, and the FBI's 2023 Internet Crime Report ranks social-engineering fraud among the costliest categories reported. Across the 35,000+ security professionals and 17,000+ organizations IRONSCALES protects, the pattern repeats: the message that reaches the inbox is rarely the one that trips a keyword rule.

What to Take Away

Treat a display of internal authority as a claim to be checked, not a fact to be obeyed. A real security team does not route you through a URL shortener to a storefront, and a subject line whose letters have been quietly swapped is telling you what it is. Verify the sender domain before you trust the sender's title, and hover the link before you follow the instruction. CISA's guidance on recognizing and stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one