Scam Alert: 'Mailbox Full' Phishing Email Exposed

• phishing
• email-security
• cyber-awareness

Beware of a new phishing scam posing as a storage alert from your email provider. Learn how to identify and avoid falling victim.

New Phishing Scam Mimics Mailbox Storage Alert

MailGuard has intercepted a sophisticated phishing campaign designed to steal users' email credentials. Disguised as a legitimate warning, the email urges recipients to manage their storage settings under the false claim that their mailbox is almost full. The goal? To trick users into revealing their login details via a fake interface.

How the Scam Works

The phishing email is titled “Your Mailbox is 99% Full” and warns that your email storage has reached 95% capacity. To create urgency, it includes a “Manage Storage Settings” button. However, clicking this button redirects users to a fraudulent login page.

• Subject line: Your Mailbox is 99% Full
• Call to action: Manage Storage Settings
• Redirect: Spoofed login page hosted on a malicious domain

Fake Login Flow

Once on the fake site, the user is prompted to enter their email address, followed by their password. After submission, a false “Signing In…” message appears, creating the illusion of legitimate activity while credentials are stolen in the background.

• Step 1: User enters email
• Step 2: User inputs password
• Step 3: Fake progress screen appears

MailGuard’s Technical Findings

MailGuard’s threat intelligence team notes that this phishing tactic uses low-complexity HTML to avoid detection. The sender spoofs the user’s own domain in the display name for credibility, but the actual sender address is a suspicious domain: `d002719(at)avas(dot)sggw(dot)pl`.

Technical Details:

• Email design: Basic HTML with embedded phishing link
• Phishing URL: Contains recipient’s email as a parameter
• Threat type: Credential phishing
• Target: Email login details

Potential Risks for Businesses

These phishing attacks are particularly harmful in a business context. A single compromised account can result in unauthorised access to sensitive documents, internal fraud, or even ransomware infiltration. Traditional email filters may not always catch these due to the minimalistic nature of the attack and the trusted display names.

How to Stay Safe

MailGuard advises users to delete any such email immediately and never click on suspicious links. Be wary of emails that:

• Are not personally addressed to you
• Contain grammatical errors or missing identifiers
• Request immediate action
• Redirect to a URL that doesn’t match your email provider

Staying vigilant and educating your team can greatly reduce the risk of falling for such scams.