MailGuard is intercepting a phishing campaign impersonating QuickBooks that uses a seemingly routine customer feedback notification to lure recipients into a fraudulent sign-in process.
The email invites recipients to review purported customer feedback for their business. Clicking the link takes users through a series of web pages featuring Intuit and QuickBooks branding, where they are prompted to enter their email address or user ID, password and, ultimately, a six-digit verification code sent to their email address.
The multi-stage approach is designed to collect sensitive login information, including a one-time verification code that could help an attacker gain unauthorised access to an account. For businesses using QuickBooks and other cloud-based financial platforms, this campaign is a timely reminder that convincing branding and familiar sign-in workflows can be used to disguise credential-harvesting attacks.
The phishing email uses the subject line “Customer feedback received” and impersonates QuickBooks.
The message tells the recipient that a customer has submitted feedback for their business and invites them to review it by clicking a prominent green “Review feedback” button.
Example phishing content shown using QuickBooks branding. Not affiliated with QuickBooks.
The email presents itself as an automated business notification. The embedded button leads to a phishing website rather than a verified QuickBooks service.
The message is designed to look routine. Customer feedback is a plausible business notification, and the familiar branding may encourage recipients to act without examining the message's origin or destination. However, the sender details provide a significant warning sign.
The email displays the sender name QuickBooks, but the displayed sender address is adriana(at)sgestudiocontable(dot)com. The underlying sending address is pm_bounces(at)pm-bounces(dot)sgestudiocontable(dot)com.
Neither address uses an official QuickBooks or Intuit domain.
MailGuard's operations team assesses that the domain may belong to a small business and could potentially have been compromised. This has not been independently confirmed, so the domain's ownership and any possible compromise should be treated as unverified.
The email also uses a tracking link associated with Postmark, an email service provider, to obscure the destination of the embedded link. The use of a recognised email delivery service does not establish that a message or its destination is legitimate.
For recipients, the key lesson is straightforward: a familiar display name and professional-looking email are not proof of authenticity.
The campaign directs recipients through a sequence of web pages that imitate elements of a legitimate QuickBooks sign-in experience. Each stage requests additional information, progressively increasing the sensitivity of the data the recipient is being asked to disclose.
Example phishing content shown using QuickBooks branding. Not affiliated with QuickBooks.
After clicking the email link, the recipient encounters a page headed “Almost there”. It describes a brief check intended to protect the page from automated access and presents a “Confirm” button.
The page appears to use a Cloudflare-style session verification mechanism. Checks of this kind are also used on legitimate websites. Their presence may therefore make a suspicious destination appear more credible to an unsuspecting visitor. They can also complicate automated inspection of malicious websites.
However, a browser verification screen does not establish that a website is safe or affiliated with the company it claims to represent.
Example phishing content shown using QuickBooks branding. Not affiliated with QuickBooks.
After the session check, the recipient is shown a page carrying Intuit branding and the message, “Let's get you into QuickBooks”.
The page asks for an email address or user ID before allowing the visitor to proceed.
This resembles a familiar account sign-in process, making the request appear consistent with an ordinary login.
In this case, however, the visitor has arrived through a suspicious email link and is interacting with a phishing site rather than a verified QuickBooks sign-in page.
Example phishing content shown using QuickBooks branding. Not affiliated with QuickBooks.
Once an email address or user ID has been submitted, the site displays another branded page asking the visitor to enter their Intuit password.
This is a critical stage of the credential-harvesting process. If the victim supplies their password, they risk disclosing their account credentials to the operators of the phishing campaign. or businesses, compromised credentials can create risks beyond the initial account. Depending on the account's permissions, connected services and security controls, an attacker may be able to access sensitive financial information, business records or other resources.
Example phishing content shown using QuickBooks branding. Not affiliated with QuickBooks.
The final observed stage asks the recipient to enter a six-digit verification code that the page claims has been sent to their email address.
This is a particularly important aspect of the campaign. The phishing site does not stop at requesting an account identifier and password; it also attempts to collect a one-time verification code.
An attacker who obtains valid credentials and a usable verification code may be able to complete an unauthorised sign-in, depending on the authentication process and the timing of the attack. This is one reason phishing campaigns increasingly seek authentication codes as well as passwords.
The screenshots demonstrate that the site requests a verification code. They do not, by themselves, establish that the attacker successfully authenticated to an account or that any account compromise occurred.
Nevertheless, the sequence illustrates why users should be wary when an unexpected email leads to a sign-in page requesting multiple pieces of sensitive information.
A familiar logo, polished interface or seemingly routine security check should never be treated as sufficient evidence that a sign-in page is legitimate.
This campaign combines several techniques that can make a phishing email more convincing and increase the potential consequences of a successful interaction.
Brand impersonation: The email and subsequent web pages use QuickBooks and Intuit branding to create the appearance of a familiar service.
A plausible business pretext: A notification about customer feedback provides a seemingly legitimate reason to click, particularly for employees who regularly manage customer relationships or business administration.
Obfuscated link routing: The use of a tracking link associated with an email delivery service can make the destination less obvious to recipients inspecting the message.
Progressive credential collection: The phishing site requests an email address or user ID, a password and a one-time verification code in successive stages.
A browser verification step: The initial session check adds another stage before the visitor reaches the credential-harvesting pages and may make the destination appear more credible.
Taken together, these characteristics demonstrate why phishing defence cannot rely solely on identifying poorly written emails, suspicious attachments or obvious requests for money.
Attackers can use professional-looking templates, recognisable branding and familiar online workflows to encourage employees to disclose sensitive information.
For organisations that depend on cloud-based business and financial applications, compromised credentials can present a risk to data confidentiality, business continuity and financial operations.
Organisations should ensure that employees understand how to recognise suspicious sign-in requests and know what to do if they encounter a potential phishing email.
Recommended precautions include:
Check the actual sender address. Do not rely on the display name or branding alone. In this example, the sender claims to be QuickBooks but uses a domain that is not an official QuickBooks or Intuit domain.
Verify links before clicking. Pay attention to the destination domain and be cautious of unexpected tracking links. If a message claims that action is required in QuickBooks, access the service independently using a trusted bookmark or a known official address.
Be wary of unexpected login prompts. A notification that asks you to sign in should not automatically be trusted simply because it resembles a familiar service.
Protect verification codes. Never enter a one-time code into a page reached through a suspicious email. Do not disclose authentication codes to other people or approve sign-in requests you did not initiate.
Use strong, unique passwords and multi-factor authentication. These controls help reduce the risk of unauthorised access, although authentication codes can still be exposed through phishing.
Report suspicious emails promptly. Employees should know how to report potential phishing to their IT or security team without interacting further with the message.
Act quickly if credentials have been exposed. Notify the security team immediately, change affected credentials through the legitimate service, revoke active sessions where possible and review account activity for suspicious sign-ins or changes.
Security teams should also assess whether their email security controls can identify suspicious sender domains, obfuscated links, brand impersonation and destinations associated with credential harvesting.
Email filtering is an important layer of defence because it can help identify malicious messages before recipients have an opportunity to interact with them. User awareness, strong authentication and effective incident response provide additional protection if a suspicious email reaches an inbox.
Stay Safe, Know the Signs
MailGuard advises all recipients of these emails to delete them immediately without clicking on any links. Responding or providing personal details can lead to identity theft, data breaches, and financial losses.
Avoid emails that:
Many businesses turn to MailGuard after a near miss or incident. Don't wait until it's too late. Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.
All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.
For a few dollars per staff member per month, you can protect your business with MailGuard's specialist AI-powered, zero-day email security. Special Ops for when speed matters! Our real-time zero-day, email threat detection amplifies our client’s intelligence, knowledge, security and defence. Talk to a solution consultant at MailGuard today about securing your company's inboxes.
Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.