Designing Spear-Phishing Campaigns That Bypass Filters

Wylie Bayes

• 3 min read

Despite the millions of dollars organizations spend on Next-Generation Firewalls and Endpoint Detection and Response (EDR) solutions, the most reliable way into a corporate network remains the same as it was twenty years ago: asking an employee to open the door for you.

Phishing is still the undisputed king of initial access. However, sending a massive blast of poorly spelled emails from a generic domain no longer works. Modern Secure Email Gateways (SEGs) like Proofpoint or Mimecast will block those campaigns instantly. For a Red Team to succeed, they must design highly targeted spear-phishing campaigns with flawless infrastructure and pristine operational security (OPSEC).

In this post, we’ll break down the technical and psychological elements of bypassing modern email filters.

The Foundation: Email Authentication Protocols

If your email infrastructure is not configured correctly, your payload doesn't matter; the email will go straight to the spam folder. Before sending a single email, a Red Team must configure three critical DNS records to prove their domain is legitimate:

  1. SPF (Sender Policy Framework): A TXT record that explicitly lists the IP addresses authorized to send emails on behalf of your domain.
  2. DKIM (DomainKeys Identified Mail): A cryptographic signature attached to the email header. The receiving server uses the public key in your DNS records to verify that the email was not altered in transit.
  3. DMARC (Domain-based Message Authentication, Reporting, and Conformance): A policy that tells the receiving server what to do if SPF or DKIM fails (e.g., quarantine the email or reject it).

A well-configured Red Team phishing domain will have restrictive, perfectly valid SPF, DKIM, and DMARC records to establish maximum trust with the target's SEG.

Building Domain Reputation

You cannot register microsoft-security-update.com today and use it to send a phishing email tomorrow. SEGs heavily penalize newly registered domains (NRDs).

To bypass this, Red Teams employ domain aging and categorization. They purchase expired domains that already have a benign history (e.g., an old local bakery website) or register new domains and let them sit for 30 to 90 days. During this waiting period, they might host a legitimate-looking placeholder site and use automated tools to simulate normal email traffic to build a positive sender reputation with Google and Microsoft.

Alternatively, attackers abuse highly reputable third-party services. By using services like SendGrid, Mailgun, or AWS Simple Email Service (SES), the phishing emails originate from IP addresses that are already explicitly trusted by most corporate spam filters.

Payload Delivery and Evasion

Once the infrastructure is trusted, the next hurdle is the payload. Attaching a malicious .exe or a macro-enabled Word document directly to an email is a guaranteed way to get caught. Modern delivery mechanisms rely on obfuscation and user interaction.

HTML Smuggling

Instead of attaching a malicious file, the attacker attaches a benign HTML file. When the user opens the HTML file in their browser, JavaScript embedded in the file uses HTML5 features to construct the malicious payload directly on the user's local machine, entirely within the browser's memory. Because the payload didn't exist when the email crossed the network perimeter, the SEG cannot scan it.

Password-Protected Archives

SEGs scan the contents of attached zip files. To prevent this, attackers send the malicious file inside a password-protected .zip or .7z file. Since the gateway does not have the password, it cannot inspect the contents. The attacker simply provides the password in the body of the phishing email for the user to type in.

Abuse of Cloud Storage

Instead of an attachment, the email contains a link to a file hosted on Google Drive, Dropbox, or SharePoint. Because these domains are universally trusted and often heavily used by the target company, the SEG will almost never block the URL.

The Psychological Pretext

A technically flawless email still requires the user to take action. This is where Open Source Intelligence (OSINT) and psychology come in.

A Red Team studies the target company's culture. They scrape LinkedIn to find internal jargon and identify vendor relationships. The most effective pretexts rely on:

  • Urgency: "Your Office 365 password expires in 2 hours. Click here to retain access."
  • Authority: An email spoofed to look like it came from the actual HR Director regarding a "Q3 Mandatory Benefits Update."
  • Familiarity: An email referencing a recent company-wide town hall meeting.

Conclusion

Successful spear-phishing is an art form that blends rigorous systems administration with psychological manipulation. By mastering email authentication, establishing domain trust, and utilizing advanced payload delivery techniques like HTML smuggling, Red Teams can reliably breach the perimeter of even the most defended organizations.