chat
expand_more

Attackers Exploit Proofpoint to Target Customers with Brand Impersonation Attacks

Learn about the recent EchoSpoofing attack that exploited Proofpoint's relay servers and how Abnormal's AI-driven approach provides superior protection against brand impersonation and advanced phishing attacks.
July 31, 2024

580,000+ EchoSpoof Attacks Blocked for Abnormal Customers

Proofpoint’s architecture introduced a flaw that enabled an attack known as “EchoSpoofing”. When emails are relayed through Proofpoint (impacting all of their customers), email authentication checks (SPF, DKIM, and DMARC) are passed and the end user inherently trusts the emails delivered to their inbox. Let's look at an example attack that bypassed Proofpoint and was stopped by Abnormal.

Disney Spoof

How did it get by Proofpoint?

  • SEGs like Proofpoint rely upon mail relays, a misconfiguration passed all required email authentication (SPF, DKIM, and DMARC).

  • The email leveraged a known brand with a sense of urgency to engage in social engineering to prompt the user to take action and click on the link.

  • Proofpoint heavily relies upon outdated methods (e.g., authentication and IOCs) to stop attacks.

What is Proofpoint’s recommendation?

  • Proofpoint advises its customers to conduct “health checks” at least quarterly to ensure appropriate configuration.

  • Dedicate additional employees to actively manage and tune their configuration on a regular basis.

  • Rely upon their TRAP product to perform post-remediation on all of the attacks they miss.

The better way to solve the problem?

  • Use a modern API architecture as provided by Abnormal that avoids these types of problems (and avoids being a point of failure in delivering email).

  • Abnormal’s AI uses thousands of signals to understand behavioral context, identifying brands like Disney through NLP and computer vision for deeper analysis.

  • Abnormal's AI goes beyond traditional indicators to keep pace with ever-shifting attack techniques (keep pace with the attackers while letting legitimate emails through)

Future-Proof Your Email Security

Don’t take our word for it. Because of our modern approach, it’s easy to see the actual attacks that are getting past Proofpoint with a 30-second integration to your cloud email provider.

Interested in learning more about Abnormal’s AI-powered solution? Schedule a demo today!

Schedule a Demo
Attackers Exploit Proofpoint to Target Customers with Brand Impersonation Attacks

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B Proofpoint Customer Story Blog 8
A Fortune 500 transportation and logistics leader blocked more than 6,700 attacks missed by Proofpoint and reclaimed 350 SOC hours per month by adding Abnormal to its security stack.
Read More
B Gartner MQ 2024 Announcement Blog
Abnormal Security was named a Leader in the 2024 Gartner Magic Quadrant for Email Security Platforms and positioned furthest for Completeness of Vision.
Read More
B Gift Card Scams Tricker to Spot Blog
Learn why gift card scams are becoming more difficult to identify, how cybercriminals evolve their tactics, and strategies to protect your organization.
Read More
B Offensive AI 12 16 24
Learn how AI is used in cybersecurity, what defensive AI vs. offensive AI means, and how to use defensive AI to combat offensive AI.
Read More
B Proofpoint Customer Story Blog 7
See how Abnormal's AI helped a Fortune 500 insurance provider detect 27,847 threats missed by Proofpoint and save 6,600+ hours in employee productivity.
Read More
B Cyberattack Forecast Emerging Threats Blog
Uncover the latest email threats and strategies to strengthen your cybersecurity and prepare for 2025.
Read More