What is the “Mailbox Abuse Notice” email

“Mailbox Abuse Notice” email is part of a phishing campaign that tries to steal users’ email login credentials. The email falsely claims that your email provider noticed an unusual login from an unrecognized device and advises that you review your recent activities. If you interact with the email and click on the link, your email login credentials may be phished and your account could be stolen.

 

 

This “Mailbox Abuse Notice” email is a very generic and common phishing attempt, it should not trick more cautious users, particularly ones who know the signs of a phishing email. The email will try to catch your attention with the “Unusual Activity Detected in Your Email Account” subject line and if you open it, you will be greeted with a supposed security alert. Supposedly, unusual activity was noticed on your account, specifically that there was a login from an unrecognized device. To secure your email account, the email advises that you check your recent activities via the provided “Review recent activity” button.

Below is the full “Mailbox Abuse Notice” email:

 

Subject: Unusual Activity Detected in Your Email Account

Mailbox Abuse Notice

Security Alert – ,

We have detected suspicious behavior in your email account that violates our security policy (Email account logged In from an unrecognized device) . You must log in to your account to review this information and verify the status of your mailbox immediately.

Review recent activity

Take these timeouts to protect your account:
– Click the above immediately in order to log into your email account.
– Go through recently carried out activities and look for anything suspicious

Any action taken in this regard will prevent your email account from being compromised.

Best Regards,

Email Service Provider
Domain Name:

If you click on the “Review recent activity” button, you will be taken to a phishing site that looks practically identical to your email provider’s site. The site asks you to log in, and if you type in your credentials, they will immediately be sent to the malicious actors operating this campaign.

Email accounts are in high demand among cybercriminals because not only do they contain a lot of sensitive and confidential information, but they could also give malicious actors access to all other accounts that are connected to the email. You must be especially careful with your email login credentials to prevent someone from accessing your account.

How to recognize phishing emails

Fortunately for regular users, phishing emails that will target them will usually be very generic and easily identifiable. Sophisticated phishing emails are usually reserved for high-profile targets whose personal information malicious actors have.

One of the first things you need to do when you receive an unsolicited email that asks you to do something like click on a link or open an attachment, is check the sender’s email address. A simple search with Google will usually suffice to determine whether the email address belongs to whomever the sender claims to be. Low-effort and generic phishing emails usually have very obviously not legitimate email addresses.

Another thing you need to pay attention to is grammar/spelling mistakes. Phishing emails are usually full of grammar and spelling mistakes, which are very obvious because the sender claims to be a legitimate company. This particular “Mailbox Abuse Notice” email is written better than many other phishing emails but it still sounds very awkward.

You should also never rush to click on a link or open email attachments when an email asks you to. You should always first carefully inspect the email and ideally, you should not click on any links. If there’s a problem with an account of yours that needs addressing, you should access the account manually instead of clicking on a link. For example, in this case, your email provider is supposedly warning you about an unrecognized login. Instead of clicking on a link, what you should do is go to your account manually and check the activity there.

Finally, to avoid typing in your email credentials on dangerous sites, always check the URL before logging in. While malicious actors can create practically identical phishing sites, the URLs will always give them away.

“Mailbox Abuse Notice” phishing email removal

You can just remove “Mailbox Abuse Notice” phishing email from your inbox if you receive it. If you did not interact with the email, there’s no need to do anything. However, if you clicked on the link and your account credentials were phished, you need to change your password immediately. You should also review your email account activities and check for any suspicious logins. If you can no longer access your account, try contacting your provider directly and using the available account recovery options. If you can no longer get into your email account, you need to remove the address from all other associated accounts to prevent them from being accessed as well.