Email-borne scams abuse trusted SaaS infrastructure and authentication to bypass defenses

Threat actors are increasingly abusing trusted SaaS platforms and email authentication to deliver high-conviction scam lures that evade traditional filtering. Trend Micro reported a targeted spam operation that weaponizes Atlassian Cloud features to send messages that pass common checks (e.g., SPF/DKIM) due to the strong reputation of SaaS sender domains; the campaign is multilingual and aims to redirect government and corporate recipients to fraudulent investment landing pages using Keitaro TDS, with attackers creating multiple Atlassian instances for resilience and scale.

Separately, Forcepoint X-Labs described phishing emails impersonating the US Social Security Administration that deliver a .cmd script to weaken Windows defenses (including disabling SmartScreen, removing Mark-of-the-Web, and using Alternate Data Streams) before silently installing ConnectWise ScreenConnect as a remote-access backdoor (including a hardcoded callback configuration). Related research highlighted DKIM replay attacks, where adversaries forward legitimate, DKIM-signed vendor emails (e.g., PayPal/DocuSign-style invoices and dispute notices) so the unchanged content continues to validate and can pass DMARC, increasing inbox placement and user trust for follow-on social engineering.