"Rikesh Vekaria and the Mimecast threat researchers have recently identified a credential harvesting phishing campaign using the Mimecast brand. The threat actors use carefully designed "secure messages" to trick recipients into believing the emails are legitimate and related to secure communications.
These campaigns leverage templates using Mimecast logos as well as other company logos to enhance their authenticity but always include the Mimecast disclaimer at the bottom of the email to further deceive the target. Real Estate companies seem to be a primary target for this campaign due to their familiarity with receiving secure messages via email. This familiarity increases the likelihood of the campaign's success, as recipients may be more inclined to trust and engage with communications that resemble legitimate secure messages.
We have identified the use of various tactics to deceive end users and bypass security filters, one of which involves utilizing rewritten links from email security providers to redirect users to phishing pages. Mimecast has observed this method across several campaigns researched in 2024. Read more about the techniques utilized here.
Once users click on these links, they are redirected to a page that closely resembles the legitimate Microsoft login page.
This campaign was first observed in early February and runs at relatively low volumes across the week with a break on the weekends. Over the last two weeks 18 thousand detections predominately targeting the Real Estate industry have been identified.
US, Real Estate
_____[CompanyName] Secured Message for r*****s@[companydomain #Ref-[random characters]
24editor[.]com/0ffice-msoft/cloud-mail/
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
