The Job Offer Came From a Learning Site Nobody Joined

Before this email could reach a single inbox, the operator had to make its targets members of a learning site.

That is the detail worth sitting with. The message was a Red Bull branded job pitch, and it arrived at four mailboxes at a creative advertising-technology company in late October. But it was not sent by a marketing tool or a compromised account. It was a copy of a private message sent inside a MoodleCloud site, and Moodle only emails those copies to people registered on that site.

So the question a defender should ask is not "who sent this?" It is "how did our employees end up as users on a stranger's learning platform?"

A notification that describes membership, not authorship

The subject line read "New message from [a first-name persona] via Red Bull." The From address was noreply@recruiting-talents[.]moodlecloud[.]com. The body closed with Moodle's standard trailer: "This is a copy of a message sent to you on the site talent-hub," followed by a reply link back into the site's message index and a prompt to download the Moodle mobile app.

Read that trailer literally. It says the recipient has an inbox on a site called talent-hub. Moodle's messaging feature is built for students and teachers on the same site to reach each other, and email delivery is a convenience copy for registered users who are not logged in.

The record does not show how the four addresses got onto the site. Bulk upload, self-registration and other routes are all possible, and none is established here. What is established is the precondition: no account on the site, no email.

Three names, none of them the brand's

The "via Red Bull" in the display name follows Moodle's notification format of sender name, then "via", then a site name. The operator typed that value into a site setting. It carries no more authority than a Wi-Fi network name.

Now line up the labels this one message exposes:

• The From display name says Red Bull.
• The trailer says the site is talent-hub.
• The hostname says recruiting-talents.

Three different identities for one site. A legitimate corporate learning portal does not usually disagree with itself like that. When the brand only lives in the configurable field and the platform-generated fields say something else, the brand is a costume.

The headers add one more tell. X-Moodle-Originating-Script pointed to message/lib.php, Moodle's user-to-user messaging library. Not a forum post, not an assignment, not an enrolment confirmation. Nothing in this message came from course activity. It was one user writing to others, and the platform faithfully relaying it.

How the pieces fit together

Mapped to MITRE ATT&CK, the chain looks like this:

• Establish accounts (T1585.003, cloud accounts): a MoodleCloud site under the operator's control, with its own subdomain and site name.
• Acquire infrastructure (T1583.001, domains): work-redbull[.]com, registered at Namecheap on 2026-07-07 with privacy-protected contact details. Nothing on the record ties it to Red Bull.
• Delivery (T1566.002, spearphishing link): a red "Schedule an Introductory Meeting" button pointing to a shortlink that resolved to the lookalike.

The pitch itself targeted the audience precisely. An eyebrow reading "CAREER OPPORTUNITIES", copy aimed at "professionals who are passionate about social media, creative content, and digital marketing", a benefit checklist and a "Red Bull HR Team" signature. For staff at an advertising-technology company, that reads like a plausible move.

The landing page showed a bot check. Nothing behind it was captured, so what it was meant to collect is not established.

Delivery ran through MoodleCloud's own Amazon SES stream. The current-hop results at Google showed DKIM passing for moodlecloud.com and for amazonses.com, SPF passing, and DMARC passing at p=QUARANTINE. That is MoodleCloud's reputation, and MoodleCloud behaved exactly as designed. The DMARC pass proves the platform sent it. It says nothing about the site owner's intent.

One supporting oddity: the footer's unsubscribe link was the literal unrendered token . The HTML was built in some other mail tool and pasted into the Moodle message box.

Indicators

See Your Risk: Calculate how many threats your SEG is missing

One report, four mailboxes

The copies arrived across roughly 20 hours, from the evening of 28 October into the afternoon of the 29th. The sender was flagged as first-time, and link scans on both the shortlink and the lookalike came back as a mixed result rather than a clean one.

What closed it was a person. An employee on the client services side reported the message, a human analyst resolved it as malicious, and every copy across all four mailboxes was quarantined, including the ones that landed after the report. That is the crowdsourced human element working as intended: one employee's judgment turned into protection for colleagues who had not opened it yet.

The numbers say this is the normal shape of the problem. The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches, with phishing the initial access vector in 16%. In the gateway-blocked email attack mix it reports, 80% is plain phishing. IRONSCALES platform data, drawn from 36,000+ security professionals across 18,000+ organizations, shows 67.5 phishing emails per 100 mailboxes each month. The FBI IC3 2024 report continues to track employment scams as a persistent fraud category, and CISA phishing guidance stresses that reporting is what breaks the attack cycle.

Read the LMS notice as a map of your exposure

Here is the defensive shift. A "New message from X via Brand" email on a learning or community platform domain is a statement about where a recipient's address has been registered. Treat it that way.

• Ask whether you use the platform at all. If your organization has no MoodleCloud site, any Moodle message copy means an employee address sits on someone else's site.
• Compare the platform-generated names. Display name, site name in the trailer and hostname should agree. Here they produced three answers.
• Check the originating script. A copy from the messaging library is one user writing to another, not a course or system event.
• Discount the authentication. The Microsoft Digital Defense Report 2024 documents how often attackers route through legitimate cloud services. A platform signature confirms the platform, nothing more.

Agentic triage such as IRONSCALES Themis can weigh those mismatches together, but the signal starts with recognising what the notification actually tells you. Per NIST, phishing is a digital form of social engineering. This one just needed a membership list first.