Phishers Impersonate DHS in Sophisticated Cloaked Email Scam

A Knowbe4 article notes that Cybersecurity researchers at INKY have uncovered a new email scam in which threat actors impersonate the US Department of Homeland Security (DHS) to exploit public anxiety around immigration policy. These emails are carefully crafted to tap into the politically charged climate surrounding the Trump Administration’s deportation actions, with some messages referencing a recent executive order and others promising access to unclaimed funds. By mimicking official government communication, the attackers aim to deceive recipients into clicking malicious links.

What makes this campaign especially concerning is its technical sophistication. INKY found that the phishing sites employ evasion tactics such as host-based cloaking or IP-targeted phishing. These techniques prevent security tools and researchers from seeing the malicious content by filtering out requests from known IP ranges or non-targeted devices. 

For example, one domain initially redirected users to the legitimate U.S. Citizenship and Immigration Services website, while another displayed a 403 Forbidden error, suggesting content delivery was selectively blocked. This evasive behavior increases the likelihood of unsuspecting users engaging with the phishing content without detection.

For cybersecurity professionals, this campaign underscores the need for heightened vigilance and advanced threat detection capabilities against email scams. Using urgency, deceptive domains, and cloaking techniques is a hallmark of modern phishing. INKY advises users to closely examine email domains and links, particularly those that claim to come from government agencies. Legitimate US government sites end in .gov or .mil; any deviation from these should raise immediate suspicion.