Aegis Threat Intelligence Series: How to Bypass a Secure Email Gateway Part 1

Backscatter Phishing: How Bounce Traffic Becomes a Payload Delivery Channel

Backscatter phishing is one of the most structurally hard to solve threats in enterprise email security today; not because it is sophisticated, but because it is invisible to the tools organizations trust most. Threat actors across multiple unrelated campaigns are exploiting legitimate Non-Delivery Reports (NDRs) to deliver live phishing payloads through Secure Email Gateways (SEGs) without triggering a single rule. The payloads arrive inside RFC-compliant bounce messages from legitimate Mail Transfer Agents (MTAs), carrying valid Sender Policy Framework (SPF) authentication, linking to attacker infrastructure hidden behind URL shorteners, bare Internet Protocol (IP) addresses, and decentralized hosting. The SEG evaluates the envelope. It passes. The payload lands.

The risk is not theoretical. In a 30 day observation window, we identified four distinct campaign clusters, spanning four languages, three continents, and four monetization models, all exploiting the same structural bypass simultaneously. Confirmed delivery into SEG protected inboxes was observed across multiple campaigns. None of the campaigns shared infrastructure, signatures, or lure types. There is no single rule that catches them all, and no reputation feed that covers a delivery chain built entirely from legitimate servers.

The reason legacy email security cannot solve this is architectural. A SEG evaluates what is in front of it: the envelope, the sending IP, the domain reputation, the attachment hash, the top-level URL. Backscatter puts the payload behind all of that by embedding malicious payloads in bounce body content that SEGs were never designed to treat as an independent threat surface. Closing that gap requires a system that can reason about what a message actually is, parse embedded payloads in context, follow redirect chains to their terminal destination, and distinguish a malicious NDR from a legitimate one based on meaning rather than metadata. That is not a rules problem. It is an agentic Artificial Intelligence (AI) problem and it is precisely what Aegis was built to solve.

The Security Gap: Backscatter vs. Secure Email Gateways

To understand why this works, you need to understand what a SEG actually evaluates.

When a phishing email is spoofed from a victim's domain and sent to third-party mail servers, those servers generate legitimate NDRs back to the spoofed sender or the victim. That NDR originates from a legitimate Mail Transfer Agent (MTA), carries valid authentication in many cases, and faithfully embeds the original phishing payload in the bounce body. When it arrives at the victim's SEG, the gateway evaluates the envelope: the sending IP is not on a blocklist, the domain is not attacker-registered, and Sender Policy Framework (SPF) passes. The gateway makes the correct determination about the wrapper and never inspects the payload embedded inside it.

The attacker's infrastructure never touches the delivery chain. The bounce servers are third-party MTAs, not attacker-controlled nodes. Blocking them means blocking legitimate bounce traffic.

What Is Backscatter?

Backscatter is collateral email — NDRs generated by mail servers that received a spoofed phishing email and bounced it back to the forged sender address. The victim receives the bounce, not the original phishing email. But because mail servers embed the original message body in the NDR, the victim receives the phishing payload all the same.

The attack surface exists because SEGs have no native mechanism to evaluate NDR body content as an independent threat object. 

Observed Campaign Activity

These are not variants of a single campaign. The payload URLs, lure types, delivery mechanisms, bounce infrastructure, target geographies, and monetization methods are all different. Four distinct clusters were identified across the 30 day dataset window including cloud storage lures, crypto scams, QR payment fraud, and bulletproof hosted shared infrastructure.

Campaign 1 — Cloud Storage Lure (URL Redirect Abuse)

Emails from this campaign carry an identical two-URL payload routing through miniurl.be — a legitimate Belgian URL shortener with an established reputation, specifically chosen to defeat domain-age heuristics and category filters. The shortener fully obscures the final payload destination (credential theft page) from any pre-click analysis.

Emails in the cluster also embeds a visual lure hosted on Imgur. No attacker-controlled domain appears in the URL set. There is nothing to blocklist.

Subject lines vary — storage quota warnings, account lockout notices, data deletion threats, and Chinese-language system bounce variants targeting Chinese-language mail providers — but the payload is identical across all of them. The lure subject changes; the infrastructure does not. Bounce sources span Greek hosting, DreamHost, Ukrainian Virtual Dedicated Server (VDS) infrastructure, and a named MXThunder relay cluster across 40+ distinct mail servers, reflecting the geographic breadth of the original spam run. A meaningful portion of these carry SPF=pass, which is why the phishing email was accepted and authenticated by legitimate servers before generating the NDR.

Campaign 2 — Crypto Scams

A different operator, a different monetization model. The original phishing email offers a multi-million dollar fund claim, directing victims to contact the operator via WhatsApp. Multiple contact numbers across Canadian, Bosnian, Dutch, and New Zealand country codes appear across variants: distributed contact infrastructure for operational continuity.

Campaign 3 — Phishing Emails Sharing BulletProof Infrastructure

These emails do not represent a single campaign, but they share common bulletproof infrastructure, which are providers that ignore abuse complaints and law enforcement requests, making them attractive shared infrastructure for multiple unrelated actors. Emails from this campaign share two bulletproof IP subnets as payload hosts: 91[.]220[.]42[.]0/24 and 195[.]130[.]217[.]0/24, but the lures, delivery mechanisms, and bounce sources are all different. Four distinct lures were observed:

1. Voicemail Notification 
   
   • Domains: vds2958463[.]my-ihor[.]ru and vds2949952[.]my-ihor[.]ru.
   • Mechanism: Posed as a voicemail with "Play Message" and "Attachment" buttons. Clicks were tracked via googleads.g.doubleclick.net before redirecting to the bulletproof IP, demonstrating classic voicemail phishing using Google infrastructure to evade URL reputation.
2. Account Review
   
   • Domain: meggadam[.]site.
   • Mechanism: Payload delivered via webservice-server-mail-8d1a5c7e2f9b4036-03l12[.]bunny[.]run (Bunny CDN) with CTAs "Review Account" and "CLICK HERE". The attacker used Bunny CDN, a legitimate content delivery network, with the bulletproof IP as a secondary resource.
3. Whois/Domain Privacy Lure
   
   • Source Domains: alma01[.]host.nhpil-ng[.]com and rhs[.]unborn[.]in.
   • Payload Domains: config[.]workcentral[.]store and dasneves[.]adv[.]br.
   • Lure Text: Displayed "Whois privacy service agreement," impersonating a domain registrar or Whois privacy service.
4. Cryptocurrency Exchanges 
   
   • Source: yesmywine[.]com bounce.
   • Content: Direct links to cex[.]io, nexo[.]com, bitpay[.]com, and paybis[.]com (all buy-Bitcoin paths), alongside the bare IP. This is a financial lure, likely a crypto fraud premise.

Campaign 4 — Japanese PayPay QR Payment Fraud

Geographically isolated to Japan. All bounce sources are Japanese mail servers; all payload content is in Japanese. The delivery mechanism differs from every other campaign in the dataset: PDF attachments rather than inline links, with PayPay QR payment codes embedded inside.

Multiple unique file hashes are present across what are functionally equivalent PDFs — the variation is intentional. Per-send hash modification is a deliberate technique to defeat gateway-level hash matching. Every email in this cluster carries no email authentication at all. SPF, DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) are absent or failing. The campaign combines three distinct evasion layers — PDF delivery, QR code payloads, and hash polymorphism — none of which are visible to a gateway evaluating the NDR wrapper.

Agentic AI vs Rule Based Security is the Answer

The SEGs in this dataset were not misconfigured. They evaluated what they were designed to evaluate, and the payload arrived in a channel they were never designed to inspect. That distinction matters, because the failure mode here is not a gap that patching or reconfiguration closes. It is structural.

What this dataset demonstrates is that backscatter is not a niche technique requiring sophisticated infrastructure or novel tooling. Four unrelated operators ran it simultaneously across a 30 day window, targeting different geographies, using different lures, and monetizing differently. The only shared element is a delivery channel that legacy email security has no framework for evaluating: the bounce body.

This is where Aegis operates differently. Rather than evaluating the envelope and stopping there, Aegis treats the embedded content of an NDR as an independent threat surface by parsing the original message body, following redirect chains, and evaluating payload intent in context. That is what allowed us to correctly identify four distinct malicious campaigns within this traffic while simultaneously flagging legitimate bounce traffic as benign.

The campaigns documented here were stopped not because they matched a known signature, but because the behavior of the embedded payload was inconsistent with legitimate bounce traffic. That is the only reliable detection surface backscatter leaves available, is one that requires an AI native email security solution, not a SEG.

‍