QuickBooks Callback Phish Passes Its Own Auth Checks

The most dangerous thing about this QuickBooks billing notice is that it passed every authentication check we ask email to pass. SPF, DKIM, and DMARC all returned green. And none of it mattered, because the attacker owned the domain doing the passing.

The target was the shared inbox of a regional HVAC and mechanical contracting firm, the kind of small operation that runs its books on QuickBooks and treats an Intuit billing warning as something to resolve before payroll breaks. The email announced a "Payment Issue with QuickBooks Subscription" and told the recipient to call a support number to keep the account from being suspended. The display name read "Intuit Inc." The urgency read like a real vendor problem.

It was not. It was callback phishing, also called telephone-oriented attack delivery, or TOAD: an attack whose real payload is a phone number rather than a link or an attachment.

Passing Auth on a Domain Intuit Never Owned

Here is the part that should reset how your team reads authentication results.

The message was sent from info@desk-qbd[.]live, and that domain fully passed SPF, DKIM, and DMARC. It passed not because a control was bypassed, but because the controls did exactly what they are designed to do. The attacker registered desk-qbd[.]live, published correct DNS records for it, and sent from it. Authentication confirmed the sender controls the domain in the From address. That is all it ever confirms.

What authentication does not do is vouch for the brand in the display name. Intuit has no relationship with desk-qbd[.]live. The "qbd" fragment gestures at QuickBooks Desktop to make the domain feel plausible at a glance, but it is attacker infrastructure wearing a trusted logo. A passing DMARC result on a lookalike domain is a statement about domain control, not brand legitimacy, and that distinction is exactly what this campaign was built to blur. If your mental model still equates "DMARC pass" with "safe," a properly configured DMARC record on an adversary's own domain quietly defeats it.

The greeting gave away the scale. "Dear Customer," with no name, no account number, no company reference. This was not a targeted spear-phish. It was a mass-distribution net cast across many mailboxes at once, and the HVAC firm was one address in a much larger sweep.

The Unsubscribe Link Was a Tripwire

The email carried exactly one clickable link, and it was labeled "Unsubscribe."

That is a deliberate choice. Recipients are conditioned to trust an unsubscribe link as the safe, responsible thing to click. This one was neither safe nor an unsubscribe. It was a two-hop tracked redirect: the click first hit track[.]chanret[.]com/trackclick.asp, then bounced to getsecuritynow[.]xyz/unsubscribe.html, a page dressed in Intuit branding.

Notice what the link did not do. It did not present a credential form. It was not trying to steal a password on click. It was a mailbox-validation probe. Anyone who clicked was fingerprinted and confirmed as a live, attentive human reading the message, which marks that address as a high-value target for the next wave. Combine a confirmed-live mailbox with a victim primed to call the "support" line, and the attacker has both a warm lead and a live phone channel.

The landing domain tells the rest of the story. getsecuritynow[.]xyz was registered roughly three weeks before delivery, on December 18, 2024, behind privacy-shielded WHOIS, on shared hosting with a PTR record that did not match. Newly registered infrastructure, hidden ownership, and a reverse-DNS mismatch are the fingerprints of throwaway attack infrastructure stood up for a single campaign.

The behavioral tell here is subtle and worth internalizing: the redirect chain functioning as a validation probe is a more revealing signal than the phone number itself. Plenty of legitimate mail contains phone numbers. Very little legitimate mail routes its lone link through a click tracker to a three-week-old privacy-shielded domain to confirm you exist.

Indicators of Compromise

Where Authentication Ends and Behavior Begins

Mapped to MITRE ATT&CK, this is T1566.002 Spearphishing Link for the tracked redirect, T1598.003 Spearphishing via Service for the callback and information-gathering vector, and T1583.001 Acquire Infrastructure: Domains for the registered lookalike and landing domains.

This is where a legacy secure email gateway, or SEG, is structurally outmatched. A gateway that gates on authentication and reputation sees a domain that passes SPF, DKIM, and DMARC, has no prior bad reputation, and carries a single benign-looking unsubscribe link. It waves the message through. IRONSCALES platform data puts numbers on that gap: SEGs miss an average of 67.5 phishing emails per 100 mailboxes each month.

Our Adaptive AI, Themis, reads the signals authentication ignores. A first-contact sender. A brand-impersonating display name floating over a domain that brand has never used. A phone-only call to action wrapped in billing urgency. A lone link routed through a click tracker to a domain that did not exist a month ago. Modeled together, those form a clear intent profile that a green DMARC result cannot launder clean. The 2024 Verizon Data Breach Investigations Report notes that the median time for a user to click a phishing link is 21 seconds, so the window to catch a message like this closes fast, and CISA's phishing guidance stresses breaking the cycle before user interaction. The Microsoft Digital Defense Report 2024 documents the same industrialization of brand-impersonation infrastructure this campaign relied on.

See Your Risk: Calculate how many threats your SEG is missing

Callback phishing works precisely because it moves the con off the wire and onto the phone, where none of your URL scanners or attachment sandboxes can follow. Voice-based fraud, or vishing, is the whole point, and the email is just the doorway. Across 35,000+ security professionals and 17,000+ organizations, the pattern IRONSCALES sees repeat is this one: attackers stopped trying to break authentication and started passing it on their own turf.

Stop grading email on authentication alone

Treat a passing SPF, DKIM, and DMARC result as table stakes, not a verdict. If your detection logic ends where authentication passes, an attacker with a correctly configured lookalike domain and a phone number walks straight through. Grade sender relationship, display-name-versus-domain mismatch, call-to-action type, and link destination age instead. The green checkmark tells you who controls the domain. It never tells you who they are pretending to be.