Custom-Crafted, Qantas-Spoofing Emails Target Australian Victims

A credential-phishing campaign spoofing Qantas marketing emails targeted primarily Australian employees, bypassing multiple SEGs (Microsoft ATP, Proofpoint, Mimecast) to drive victims to short-lived phishing sites sharing an “auth/auhs1” path. The emails closely mimicked Qantas branding and included unsubscribe headers (subscriptions.pstmrk.it) to boost legitimacy. The phishing flow collected contact details and DOB before soliciting credit card data and simulating MFA, indicating a financially motivated operation with potential for follow-on attacks using harvested PII.