The Mimecast Threat Research team continues to track MCTO3001, a sustained credential harvesting operation that has specifically targeted Australian organizations since 2023. MCTO3001 operates year-round with evolving lure themes, exploiting the authority and trust associated with government communications. The threat actors behind MCTO3001 employ a consistent tactical approach, predominantly utilizing compromised email accounts alongside legitimate bulk email services including SendGrid, Mailgun, and Office 365 infrastructure.
A defining characteristic of MCTO3001 is the systematic use of .gov.au or reference to gov display names paired with non-government sending infrastructure. Email headers consistently show forged or completely absent recipient fields in the "To:" headers, indicating email header manipulation designed to evade detection while maintaining the appearance of official government correspondence. The operation strategically impersonates Services Australia, leveraging detailed knowledge of Australian benefit systems including Superannuation, Medicare, JobSeeker payments, and Family Tax Benefits.
The latest MCTO3001 phishing campaign targets Australian users, particularly those with Centrelink accounts. The primary lure used in this campaign is an email that claims a "detected sign-in" or suspicious login attempt has occurred on the recipient’s Centrelink account.
The email, crafted to closely mimic official Centrelink or myGov communications, urges the recipient to verify their account by clicking a provided link. This social engineering tactic leverages urgency and fear, prompting users to act quickly and without due caution.
Once the victim clicks the link, they are directed to a fake MyGov login page designed to harvest their credentials
A key technical feature of this campaign is the abuse of Portmap.io, a legitimate reverse tunnelling service. Portmap.io allows users to expose local servers to the internet by creating public-facing URLs that forward traffic to a machine behind NAT or firewalls.
Threat actors like MCTO3001 exploit this service to rapidly deploy phishing sites without the need to register new domains or purchase hosting. Each phishing instance can use a unique, randomly generated subdomain and port (e.g., hxxps://michdev-44475[.]portmap[.]io:44475/wett/tat/), making it difficult for defenders to block or blacklist the infrastructure. The use of Portmap.io also complicates attribution, as the true origin of the phishing server is hidden behind the service’s infrastructure, and these tunnels allows attackers to quickly rotate or dismantle their infrastructure to evade detection and takedown efforts.
Mimecast has implemented detection capabilities specifically targeting MCTO3001's Australian government impersonation patterns, including analysis of Services Australia communication styles and benefit suspension terminology.
Broad targeting across multiple Australian industries and sectors
Malicious URLs:
Common Subject Line Patterns:
Proactive Threat Hunting:
Security Awareness:
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
