Protect your business from QuickBooks impersonation phishing attacks with Darktrace Email and learn how to defend against cyber threats.
Recently in the Darktrace Blog we’ve explored how the current working conditions have resulted in a huge surge in spoofing and impersonation attacks, where attackers masquerade either as trusted colleagues or familiar brands.
These types of email attacks continue to be a successful tactic for cyber-criminals. Forever responsive and adaptive, attackers are taking advantage of the disruption to everyday operations by impersonating credible suppliers to send in fake invoices and other fraudulent emails.
How AI caught a fake invoice attack
This blog explores a string of counterfeit invoices sent to dozens of employees at a cutting-edge technology company. With valuable IP and several research labs, the company is a prime target for organized and ambitious cyber-criminals seeking maximum financial reward for their campaigns. In this particular incident, the threat-actors convincingly impersonated QuickBooks, a leading provider of book-keeping and accounting software, and part of the Intuit group which includes other recognizable brands like TurboTax and Mint.
The spoofed emails contained an invoice notification that closely imitated a legitimate monthly invoice that the organization would expect to receive from QuickBooks. If successfully delivered to the inbox, these would have appeared to come from quickbooks@notification.intuit[.]com.
The ‘invoice’ attached to these emails was actually a macro-containing Office document.
Figure 1: The malicious attachment shown in the Threat Visualizer
The source of the spoofed emails was an IP address in Italy. Since this falls outside the range of IPs that are permitted by Intuit to send mail on their behalf, this breached the SPF model breach within Antigena Email.
However, that in itself was not the main cause for Darktrace/Email’s detection – any mail server can run an SPF check. The primary factor behind the 100% anomaly score that Darktrace/Email assigned these emails was the high sender history of the email address – Darktrace was able to see that the failed SPF results were particularly suspicious against the background of SPF passes usually assigned to quickbooks@notification.intuit[.]com.
In addition, Darktrace/Email recognized that it would be highly unusual for this group of recipients, across multiple departments, to be receiving the same email from the same source – particularly of that particular subject matter. This caused the Cyber AI to hold the emails back in some cases, and in others it took the action to ‘unspoof’ the email, revealing that the invoice was not in fact from Quickbooks.
Figure 2: Five of the offending emails, deemed 100% anomalous by Darktrace/Email
The above illustrates how these emails appeared in Darktrace’s Threat Visualizer, in comparison to normal legitimate invoices below. Note the identical sender address and similar style of subject line. Had Darktrace’s AI not been analyzing every inbound email in real time, these attacks would have been highly likely to succeed.
Figure 3: Genuine invoices received from Intuit in the same week
The below is a full list of the model breaches piled onto these emails, producing the overall anomaly score of 100% seen above.
Attachment/Dangerous AttachmentAttachment/SPF Anomalous AttachmentAttachment/Spoof Sender AttachmentAttachment/Unsolicited AttachmentSpoof/Meta Popular Domain SpoofType/High Sender HistoryUnusual/Behavioral AnomalyUnusual/Connection AnomaliesValidation/SPF AnomalousValidation/SPF Fail Known Correspondent
Catching the full range of email attacks
Thankfully, the organization in question was an early adopter of a Self-Learning, AI-powered approach to email security, and the attack was contained at an early stage. But this attack is nothing extraordinary – and these kind of impersonation attempts are affecting organizations across every industry on a daily basis.
The extension of the tax season in the US this year has brought with it a widened opportunity for cyber-criminals to exploit the flurry of activity with fake invoices and other similar attacks. Predictably, a second surge of attacks targeting individuals and small businesses has been reported.
We have already seen an increase of COVID-19 related email attacks. With attackers impersonating trusted brands like Intuit’s TurboTax and QuickBooks, the necessity for defenders to adopt Cyber AI as part of their email security defense is more prevalent than ever.
Like this and want more?
Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newsletter
Enjoying the blog?
Sign up to receive the latest news and insights from the Darktrace newsletter – delivered directly to your inbox
Thanks for signing up!
Look out for your first newsletter, coming soon.
Oops! Something went wrong while submitting the form.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Mariana Pereira
VP, Field CISO
Mariana is the VP, Field CISO at Darktrace, and works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience, and how to implement AI technology as a means of defense. She speaks regularly at international events, with a specialism in presenting on sophisticated, AI-powered email attacks. She holds an MBA from the University of Chicago, and speaks several languages including French, Italian, and Portuguese.
Supply chain attacks are becoming increasingly sophisticated. As network defenses improve, threat actors continuously adapt and refine their tactics, techniques, and procedures (TTPs) to achieve their goals. In recent years, this has led to a rise in the exploitation of trusted services and software, including legitimate browser extensions. Exploitation of these extensions can provide adversaries with a stealthy means to infiltrate target networks and access high-value accounts undetected.
A notable example of this trend was the compromise of the Cyberhaven Chrome extension at the end of 2024. This incident appeared to be part of a broader campaign targeting multiple Chrome browser extensions, highlighting the evolving nature of supply chain attacks [1].
What is Cyberhaven?
Cyberhaven, a US-based data security organization, experienced a security breach on December 24, 2024, when a phishing attack reportedly compromised one of their employee's credentials [2]. This allowed attackers to publish a malicious version of the Cyberhaven Chrome extension, which exfiltrated cookies and authenticated sessions from targeted websites. The malicious extension was active from December 25 to December 26 – a time when most businesses and employees were out of office and enjoying the festive period, a fact not lost on threat actors. The attackers, likely a well-organized and financially motivated group, compromised more than 30 additional Chrome extensions, affecting more than 2.6 million users [3]. They used sophisticated phishing techniques to authorize malicious OAuth applications, bypassing traditional security measures and exploiting vulnerabilities in OAuth authorizations. The primary motive appeared to be financial gain, targeting high-value platforms like social media advertising and AI services [4].
In late December 2024, multiple Darktrace customers were compromised via the Cyberhaven Chrome extension; this blog will primarily focus on Darktrace / NETWORK detections from one affected customer.
Darktrace’s coverage of Cyberhaven compromises
On December 26, 2024, Darktrace identified a series of suspicious activities across multiple customer environments, uncovering a structured attack sequence that progressed from initial intrusion to privilege escalation and data exfiltration. The attack was distributed through a malicious update to the Cyberhaven Chrome extension [2]. The malicious update established a foothold in customer environments almost immediately, leading to further anomalies.
As with other Chrome browser extensions, Cyberhaven Chrome extensions were updated automatically with no user interaction required. However, in this instance, the automatic update included a malicious version which was deployed to customer environments. This almost immediately introduced unauthorized activity, allowing attackers to establish a foothold in customer networks. The update allowed attackers to execute their objectives in the background, undetected by traditional security tools that rely on known indicators of compromise (IoCS) rather than identifying anomalies.
While multiple customer devices were seen connecting to cyberhaven[.]io, a legitimate Cyberhaven domain, Darktrace detected persistent beaconing behavior to cyberhavenext[.]pro, which appeared to be attempting to masquerade as another legitimate Cyberhaven domain. Darktrace recognized this activity as unusual, triggering several model alerts in Darktrace / NETWORK to highlight the persistent outbound connections to the suspicious domain.
Further analysis of external connectivity patterns indicated an increase in anomalous HTTP requests alongside this beaconing activity. Multiple open-source intelligence (OSINT) sources also suggest that the cyberhavenext[.]pro endpoint is associated with malicious activities [5].
Figure 1:Darktrace / NETWORK’s detection of beaconing activity to cyberhavenext[.]pro
Analysis using Darktrace’s Advanced Search revealed that some of these connections were directed to the suspicious external IP address 149.28.124[.]84. Further investigation confirmed that the IP correlated with two SSL hostnames, including the malicious cyberhavenext[.]pro, further reinforcing its connection to the attack infrastructure.
Figure 2: Darktrace Advanced Search analysis showing the IP address 149.28.124[.]84 correlating to two SSL hostnames, one of which is cyberhavenext[.]pro.
Between December 23 and December 27, Darktrace observed sustained beaconing-like activity from affected devices on the customer’s network.
Figure 3: Darktrace’s detection of beaconing activities from a customer device to the endpoint 149.28.124[.]84 between December 23 and December 27.
Darktrace observed 27 unique devices connecting to the malicious command-and-control (C2) infrastructure as far back as December 3. While most connections were brief, they represented an entry point for malicious activity. Over a two-day period, two devices transmitted 5.57 GiB of incoming data and 859.37 MiB of outgoing data, generating over 3 million log events across SSL, HTTP, and connection data.
Subsequent analysis identified a significant increase in unauthorized data transfers to the aforementioned 149.28.124[.]84 IP on another customer network, highlighting the potential broader impact of this compromise. The volume and frequency of these transfers suggested that attackers were leveraging automated data collection techniques, further underscoring the sophistication of the attack.
Figure 4: Darktrace’s detection of the likely exfiltration of 859.37 MiB to the endpoint 149.28.124[.]84.
External research suggested that once active, the Cyberhaven extension would begin silently collecting session cookies and authentication tokens, specifically targeting high-value accounts such as Facebook Ads accounts [4]. Darktrace’s analysis of another affected customer noted many HTTP POST connections directed to a specific URI ("ai-cyberhaven"), while GET requests contained varying URIs prefixed with "/php/urlblock?args=AAAh....--redirect." This activity indicated an exfiltration mechanism, consistent with techniques observed in other compromised Chrome extensions. By compromising session cookies, attackers could potentially gain administrative access to connected accounts, further escalating their privileges [4].
Conclusion
This incident highlights the importance of monitoring not just endpoint security, but also cloud and browser-based security solutions, as attackers increasingly target these trusted and oft overlooked vectors.
Ultimately, by focusing on anomaly detection and behavioral analysis rather than static signatures and lists of ‘known bads’, Darktrace was able to successfully detect devices affected by the Cyberhaven Chrome browser extension compromise, by identifying activity that would likely have been considered legitimate and benign by traditional security solutions.
This compromise also serves as a reminder that supply chain attacks are not limited to traditional software vendors. Browser extensions, cloud-based applications, and SaaS services are equally vulnerable, as evidenced by Darktrace's detection of Balada Injector malware exploiting WordPress vulnerabilities to gain unauthorized network access [6]. Therefore, increased targeting of browser-based security tools, and a greater exploitation of OAuth and session hijacking techniques are to be expected. Attackers will undoubtedly refine their methods to infiltrate legitimate vendors and distribute malicious updates through trusted channels. By staying informed, vigilant, and proactive, organizations can mitigate exposure to evolving supply chain threats and safeguard their critical assets from emerging browser-based attack techniques.
Credit to Rajendra Rushanth (Cyber Analyst) Justin Torres (Senior Cyber Analyst) and Ryan Traill (Analyst Content Lead)
Global Technology Provider Transforms Email Threat Detection with Darktrace
At a glance
Within just one month of using Darktrace / EMAIL, the volume of suspicious emails requiring analyst attention dropped by 75%, saving analysts 45 hours per month on analysis and investigation.
By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on developing new capabilities and tackling more complex, rewarding projects.
Darktrace recently detected and blocked a highly sophisticated and personalized phishing email that spoofed a Microsoft SharePoint and Teams website and used advanced engineering to impersonate the school of an employee’s family member.
The transition from the incumbent solution to Darktrace / EMAIL was seamless and undetectable to the company’s vast of customers and partners, reinforcing the security organization’s role as a business enabler—protecting the company and reducing risk without adding friction.
Securing a complex, distributed business without disruption
The company remains at the forefront of technological innovation and transformation; however, its success and ambitions come with the challenges of managing a distributed global business—balancing digital advancements, existing technology investments, and evolving compliance requirements.
Optimizing a complex tech stack for scalable growth
The organization operates a diverse technology stack spanning Windows, Mac, Linux, and multiple cloud environments, creating a complex and challenging IT landscape. The company’s Chief Information Security Officer (CISO) emphasizes the need for efficiency and agility. “Our goal is to scale and deliver new capabilities without increasing headcount, ensuring that costs remain proportionate to growth.”
Balancing security, governance, and business agility
Committed to responsible practices, this industry leader prioritizes secure and trustworthy technology for its customers who rely on its solutions. “Balancing business agility with governance is a constant challenge," said the CISO. "There’s always a natural push and pull, which I believe is healthy—but achieving the right balance is delicate.”
Protecting critical workflows without impacting productivity
For the organization, email is much more than just a communication tool. “Email plays a critical role in our engineering workflows and is fundamental to how we build our products.” Because of this, the company is extremely cautious about implementing any solution that could introduce friction or disrupt productivity. “There is zero tolerance for disruption, which is why we take a deliberate and methodical approach when evaluating, selecting, and deploying our tools and solutions,” he said.
More than a vendor: A security partner invested in success
To ensure an optimal security infrastructure, the enterprise security team regularly evaluates market technologies to their existing solutions. With the rapidly evolving threat landscape, the CISO said they “wanted to validate whether we still had best-in-class protection and the right controls in place to secure our organization. It was about assessing whether we could do better in our ongoing effort to fine-tuning our approach to achieve the best possible outcome.”
The team evaluated 15 different email security vendors based on the following criteria:
Efficacy to detect threats
Ability to integrate with existing tooling
Ease of use
A vendor’s approach to partnership
They initially narrowed the list to five vendors, conducting demo sessions for deeper evaluations before selecting three finalists for a proof of value (POV). “We analyzed actual malicious emails with each vendor to assess the accuracy of their detections, allowing for an objective comparison,” said the CISO.Through this rigorous process, the Darktrace / EMAIL security solution emerged as the best fit for their business. “Darktrace’s product performed well and showed a genuine commitment to partnering with us in the long-term to ensure our success.”
The team objectively understood where there were gaps across the different vendors, where they were strong, and where they could use improvement. “Based on the analysis, we knew that Darktrace / EMAIL could deliver as the data supported it, in our specific use cases.
Partnership, integrity and respect
Throughout the evaluation process, the importance of partnership and mutual respect remained an essential factor to the CISO. “I wanted a company we could develop a long-term strategic partnership with, one that could extend far deeper than just email.” A key factor in choosing Darktrace was the commitment and engagement of its team at every level of the organization. “Darktrace showed integrity, patience and a genuine investment in building a strong relationship with my team. That's why we're here today.”
“Together, we've delivered some fantastic outcomes”
For the organization, Darktrace / EMAIL has played a crucial role in reducing risk, empowering analysts, and enabling a lean, effective security strategy. “Together, we've delivered some fantastic outcomes,” said the CISO.
Reducing risk. Empowering analysts
“Within that first month, we saw a 75% drop in suspicious emails that that required manual review, which reduced the time my team spent analyzing and investigating by 45 hours per month,” said the CISO. The security team values Darktrace / EMAIL not only for its ease of use but also for the time it frees up for more meaningful work. “Giving my team the opportunity to tackle complex challenges they enjoy and find more stimulating is important to me.” As they continue to fine-tune and optimize balance levels within Darktrace / EMAIL, he expects even greater efficiency gains in the coming months.
Maximizing protection while staying lean
It’s important for the security group to be proportionate with their spending, said the CISO. “It's all about what is enough security to enable the business. And that means, as our organization grows, it's important that we are as lean and as efficient as possible to deliver the best outcomes for the business.” Embracing an AI-powered automated approach is an essential component to achieving that goal. By offloading most manual, repetitive tasks to Darktrace / EMAIL, the company’s skilled security analysts can focus on more strategic and proactive initiatives that enable the business.
Protecting employees from advanced social engineering threats
Recently, Darktrace detected a malicious email targeting an employee, disguised as a spoofed Microsoft SharePoint and Teams website. What made this attack particularly sophisticated was its personalization — it impersonated the school where the employee’s family member attended. Unlike mass malicious emails sent to thousands of people, this was a highly targeted attack, leveraging advanced social engineering tactics to exploit connections within the education system and between family members.
Protecting without disrupting
A seamless migration is often overlooked but is critical to success for any organization, said the CISO. With a wide ecosystem of partners, email is a highly visible, business-critical function for the organization — "any friction or downtime would have an immediate impact and could throttle the entire business,” he said. However, the transition from their previous solution to Darktrace / EMAIL was exceptionally smooth. “No one realized we changed providers because there was no disruption — no incidents at all. I cannot emphasize just how important that is when I'm trying to position our security organization as an enabling function for the business that protects and reduces risk without adding friction.”
A security partnership for the future
“To survive as a business over the next few years, adopting AI is no longer optional—it’s essential,” said the CISO. However, with the cybersecurity market becoming increasingly saturated, selecting the right solutions and vendors can be overwhelming. He stresses the importance of choosing strategic partners who not only deliver the outcomes you need, but also deeply understand your organization’s unique environment. “You’re only as strong as your partners. Technology innovation and the cybersecurity market are always changing. At some point every solution will face a challenge—it’s inevitable. The differentiator will be how people respond when that happens.”