CMC Invest phishing scam uses “Regulatory Security Notice” to steal login credentials

MailGuard has detected a new phishing campaign impersonating CMC Markets, targeting recipients with a convincing “Regulatory Security Notice” designed to harvest account credentials.

This campaign is currently being intercepted across MailGuard’s filter network and represents a clear example of how attackers are increasingly leveraging compliance and security messaging to create urgency and trust.

What the scam works

Recipients receive an HTML phishing email impersonating a regulatory security notice, as shown below, requesting immediate verification.

The subject line reads: “Regulatory Security Notice — Immediate Verification Required”

The message claims that users must verify their identity to maintain access to their trading account. It references fraud prevention, compliance obligations, and multi-factor authentication, all designed to appear legitimate and routine, and with a single call to action, prompting users to click a link to “Complete verification.”

Fake login page captures credentials

Clicking the link redirects the recipient to a spoofed login page designed to closely resemble the legitimate trading platform. The page prompts users to enter their username and password.

Once entered, the site may display an error message, encouraging repeated attempts, a common tactic to ensure credentials are captured.

Behind the scenes, this is a credential harvesting operation. Any information entered is transmitted directly to the attacker.

Technical indicators of the scam

MailGuard analysis identified several consistent indicators:

Display name:
CMC-reply

Display address domain:
Randomised addresses using @ouvgpx.com
Examples include:

• wuirbw7opi(at)ouvgpx(dot)com
• 072yuk02qc25h07rko(at)ouvgpx(dot)com
• qrtwex03crn1ijrbwaw(at)ouvgpx(dot)com
• 9pjczl(at)ouvgpx(dot)com

Sending address pattern:
Unique per message, following this structure:
bounce+54260278-[random string]-[recipient email](at)em7696.ouvgpx(dot)com

A wide level of variation helps attackers evade traditional filtering and detection methods.

Why this scam is effective

This campaign does not rely on malware or technical exploits. Instead, it exploits trust and routine.

• The language mirrors legitimate compliance communications
• The branding and layout are familiar to financial platform users
• The request feels procedural, not suspicious
• The urgency is framed as account access, not alarm

This is consistent with a broader trend where phishing attacks are designed to blend seamlessly into normal business workflows.

For organisations, this creates a challenge. These emails don’t look like attacks. They look like business as usual.

What to watch out for

Even well-crafted phishing emails leave subtle indicators:

• Requests for urgent verification tied to account access
• Generic greetings such as “Dear Valued Client”
• Links that redirect to domains unrelated to the legitimate organisation
• Sender addresses that do not match official company domains

In this case, the use of randomised domains and unique sending patterns is a strong signal of malicious intent.

What recipients should look out for

There are several indicators in this campaign that recipients and security teams should treat as red flags:

• The sender email address does not match the legitimate company being impersonated
• The message creates urgency around domain deletion, interruption or data loss
• The call to action directs the user to a payment page rather than a normal account portal
• The payment page requests sensitive card details immediately
• The destination URL is not the legitimate domain of the business referenced in the email

Even where branding, layout and language appear convincing, these signals matter. Attackers are increasingly using polished pages and familiar business workflows to disguise credential theft and payment fraud.

MailGuard advises all recipients of these emails to delete them immediately without clicking on any links. Responding or providing personal details can lead to identity theft, data breaches, and financial losses.

Avoid emails that:

• Aren’t addressed to you personally.
• Are unexpected and urge immediate action.
• Contain poor grammar or miss crucial identifying details.
• Direct you to a suspicious URL that isn’t associated with the genuine company.

Many businesses turn to MailGuard after a near miss or incident. Don't wait until it's too late. Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.

One Email Is All That It Takes   

All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.     

For a few dollars per staff member per month, you can protect your business with MailGuard's specialist AI-powered, zero-day email security. Special Ops for when speed matters!  Our real-time zero-day, email threat detection amplifies our client’s intelligence, knowledge, security and defence. Talk to a solution consultant at MailGuard today about securing your company's inboxes.  

Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.