Experiencing Phishing with Mandrillapp URLs?

I’ve been dealing with a similar problem. One thing I’ve found effective is creating transport rules that flag emails containing those mandrillapp.com URLs for manual review instead of auto-blocking them. This allows us to evaluate potentially harmful messages without losing out on legitimate correspondence. Furthermore, employing tools like Abnormal AI is beneficial, as it can identify behavioral patterns that Microsoft Defender misses.

Such a frustrating situation! You’re right about DMARC; it's working as it's supposed to since the phishing emails are using legitimate Mandrill infrastructure. This makes SPF and DKIM checks pass perfectly. The key here is enhancing your URL reputation scanning. Until Microsoft improves their URL intelligence, it’s like playing whack-a-mole. A temporary solution could be adding a warning banner to any external emails that contain those tracking URLs, which helps your users remain cautious.

This is a widespread issue. Attackers often create new Mailchimp/Mandrill accounts and leverage their infrastructure because the emails pass authentication checks, so Defender trusts them by default. A couple of actions that could help you are reporting these accounts to Mailchimp at [email protected]. They tend to act on these cases quickly. You can also set up mail rules to flag or block URLs with mandrillapp.com/track/click if the volume of phishing attempts justifies it. Additionally, ensure your own domain has DMARC set to p=reject to prevent spoofing.

I've seen a lot of this too! One strategy I've been using is to block sender domains and other URLs included in those phishing emails using Tenant Allow/Block Lists. First, I check the Security portal to see if we've received any legitimate emails from those sender domains or other URLs in the emails. If I find none, I block those domains for 90 days to keep the emails from reaching the inbox. I know it might hurt some innocent domains, but if we haven't interacted with them, it's a necessary action. If I have time, I report the phishing URLs to Microsoft and others as well.