Blog
/
/
July 12, 2020

Darktrace AI Email Finds Chase Fraud Alert

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
12
Jul 2020
Stop Chase fraud alerts! Learn how Darktrace AI email security caught a malicious email impersonating Chase bank, preventing credential theft in real time.

In a previous blog, we analyzed a phishing attack that impersonated QuickBooks, an accounting software, in an attempt to install malware across an organization. This blog demonstrates another recent threat find where the brand of a trusted financial organization was leveraged to launch an email attack.

With an annual revenue of over $100 billion, Chase is the second largest issuer of credit cards in the US. It is unsurprising that this well-known, trusted brand is used by attackers in phishing attacks. With the recent surge in e-commerce transactions, together with increased scrutiny regarding digital security, consumers are on high-alert when it comes to the security of their banking details. A ‘fraud alert’ from a financial institution triggers stress and anxiety, and recipients may rush to take action, forgetting security training and clicking on links even if they appear to be suspicious. By playing on human emotions, attackers increase their likelihood of success.

The anatomy of an attack

An attacker appears to have invested a significant amount of research and preparation into crafting a legitimate-looking Chase fraud alert.

Figure 1: A partial recreation of the malicious email

In the phishing email above the recipient is asked to confirm that a listed transaction is legitimate. The notification, whether received through email, text message, or an app, will usually include the name of the vendor, date and time of the transaction, and the amount of money. The attacker has gone to the trouble to replicate this, listing specific suspicious transactions.

Attackers often leverage well-known brands like Chase to indiscriminately target a large pool of inboxes. They are statistically likely to find a Chase customer without having to go through the effort of actually hacking Chase’s CRM.

But while emails like these bypass legacy tools and often fool the human recipient, they are easily detected by Antigena Email’s contextual understanding of anomalous activity and stopped by its autonomous response.

How AI caught the fake fraud alert

In this case, as soon as the spoofed fraud alert hit the inbox, Antigena Email detected that the email was unusual, giving the email an 100% anomaly score.

100%

Mon Jun 22 2020, 10:38:34

From:Chase Fraud Alert <chase@fraudpreventino.czh.com>

Recipient:Kirsty Dunhill <kirsty.dunhill@holdingsinc.com>

Action Needed: Confirm you made these purchases

Email Tags

Suspicious Link

New Contact

Unknown Correspondent

Actions on Email

Lock Link

Hold Message

Figure 2: Darktrace’s AI surfacing the email as 100% anomalous

With this high anomaly score indicating a highly unusual email, Antigena Email automatically held it back from the user’s inbox.

The sender’s domain, ‘fraudpreventino’, is visually similar to ‘fraudprevention’ – the domain of the legitimate website – so the look-a-like could be easily misread as legitimate by a user.

However, in Antigena Email dashboard’s advanced tab, we see the metrics for KCE and KCD are both 0, indicating that this is a new email address that has not previously corresponded with either the recipient or anyone else within the organization. Additionally, we can see that DKIM failed and there is no SPF record, and so there were no records to validate the authenticity of the email.

Figure 3: The Threat Visualizer shows the emails have failed SPF and DKIM checks

Antigena Email detected other unusual aspects of the email indicating that it was an attack. The email contained a number of anomalous links and there was an inconsistency between the displayed link address and the actual destination of the hyperlink.

The display link in this particular email was a newly registered domain at the time the email was sent. Not surprisingly, this domain is now being identified as a malicious page. However, at the time the email was sent, the domain was not listed on ‘deny lists’ and would have slipped past spam filters or legacy security tools.

Upon clicking the link, the user would have been presented with a fraudulent Chase login screen. This is a common credential harvesting technique – when the user enters their credentials, they unknowingly hand over this information to the attacker.

Figure 4: The fake Chase login screen with credential harvesting malware

The website has now also been recognized as malicious, with users now presented with a warning encouraging them to think twice before entering sensitive information.

Figure 5: The page is later recognized as harmful by the web browser

It is not clear how long the fake login page was in existence before it was added to ‘denylists’, but what is certain is that Antigena Email was able to prevent the attack by holding back the email even without any threat intelligence on the attacker technique, ensuring no damage was done.

Figure 6: Antigena Email recognizes when a malicious link is hidden behind a misleading button

In addition to this button, the attacker also took time to add many legitimate Chase links and images. By padding the email with mostly valid content and links, the attacker attempted to deceive legacy email security tools into perceiving the email as benign. Notice below that these all link to the legitimate address for ‘fraudprevention,’ which itself was used as the source of the altered domain name for the sender.

Figure 7: The full list of links contained in the email

Defending against sophisticated phishing attacks

Attackers continue to leverage social engineering tactics to play on human error and fear in increasingly targeted phishing attacks, crafting nuanced misspellings in their domain names, padding emails with legitimate links, and creating a false sense of urgency. Self-learning AI that can spot and stop threats with both machine speed and precision becomes a critical tool at a time when humans have become even more susceptible as people’s stress and anxiety levels have become heightened by global disruption.

Of course, in this attack there is an irony in that the order of operations is directly inverted: first comes the notification, then comes the fraud. But with Antigena Email, attacks like this are stopped in their tracks, protecting employees and organizations from harm.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Mariana Pereira
VP, Field CISO

Mariana is the VP, Field CISO at Darktrace, and works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience, and how to implement AI technology as a means of defense. She speaks regularly at international events, with a specialism in presenting on sophisticated, AI-powered email attacks. She holds an MBA from the University of Chicago, and speaks several languages including French, Italian, and Portuguese.

Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

OT

/

April 4, 2025

Darktrace Named as Market Leader in the 2025 Omdia Market Radar for OT Cybersecurity Platforms

Default blog imageDefault blog image

We are pleased to announce that Darktrace / OT has been named a Market Leader in Omdia’s  2025 Market Radar for OT Cybersecurity Platforms. We believe this highlights our unique capabilities in the OT security market and follows similar recognition from Gartner who recently named Darktrace / OT as the sole Visionary in in the Magic Quadrant for Cyber Physical Systems (CPS) Protection Platforms market.

Historically, IT and OT systems have been managed separately, creating challenges due to the differences of priorities between the two domains. While both value availability, IT emphasizes confidentiality and integrity whereas OT focuses on safety and reliability. Organizations are increasingly converging these systems to reap the benefits of automation, efficiency, and productivity (1).

Omdia’s research highlights that decision makers are increasingly prioritizing comprehensive security coverage, centralized management, and advanced cybersecurity capabilities when selecting OT security solutions (1).

Rising productivity demands have driven the convergence of OT, IT, and cloud-connected systems, expanding attack surfaces and exposing vulnerabilities. Darktrace / OT provides a comprehensive OT security solution, purpose-built for critical infrastructure, offering visibility across OT, IoT, and IT assets, bespoke risk management, and industry-leading threat detection and response powered by Self-Learning AITM.

Figure 1: Omdia vendor overview for OT cybersecurity platforms
Figure 1: Omdia vendor overview for OT cybersecurity platforms

An AI-first approach to OT security  

Many OT security vendors have integrated AI into their offerings, often leveraging machine learning for anomaly detection and threat response. However, only a few have a deep-rooted history in AI, with longstanding expertise shaping their approach beyond surface-level adoption.

The Omdia Market Radar recognizes that Darktrace has extensive background in the AI space:

“Darktrace has invested extensively in AI research to fuel its capabilities since 2013 with 200-plus patent applications, providing anomaly detection with a significant level of customization, helping with SOC productivity and efficiency, streamlining to show what matters for OT.” (1)

Unlike other security approaches that rely on existing threat data, Darktrace / OT achieves this through Self-Learning AI that understands normal business operations, detecting and containing known and unknown threats autonomously, thereby reducing Sec Ops workload and ensuring minimal downtime

This approach extends to incident investigations where an industry-first Cyber AI AnalystTM automatically investigates all relevant threats across IT and OT, prioritizes critical incidents, and then summarizes findings in an easily understandable view—bringing production engineers and security analysts together to communicate and quickly take appropriate action.

Balancing autonomous response with human oversight

In OT environments where uptime is essential, autonomous response technology can be approached with apprehension. However, Darktrace offers customizable response actions that can be set to “human confirmation mode.”

Omdia recognizes that our approach provides customizable options for autonomous response:

“Darktrace’s autonomous response functionality enforces normal, expected behavior. This can be automated but does not need to be from the beginning, and it can be fine-tuned. Alternative step-by-step mitigations are clearly laid out step-by-step and updated based on organizational risk posture and current level of progress.” (1)

This approach allows security and production to keep humans-in-the-loop with pre-defined actions for potential attacks, enforcing normal to contain a threat, and allowing production to continue without disruption.  

Bespoke vulnerability and risk management

In the realm of OT security, asset management takes precedent as one of the key focus points for organizations. With a large quantity of assets to manage, practitioners are overwhelmed with information with no real way to prioritize or apply them to their unique environment.

Darktrace / OT is recognized by Omdia as having:

“Advanced risk management capabilities that showcase metrics on impact, exploit difficulty, and estimated cost of an attack […] Given the nascency of this capability (April 2024), it is remarkably granular in depth and insight.” (1)

Enabling this is Darktrace’s unique approach to AI extends to risk management capabilities for OT. Darktrace / OT understands customers’ unique risks by building a comprehensive and contextualized picture that goes beyond isolated CVE scoring. It combines attack path modeling with MITRE ATT&CK  techniques to provide hardening recommendations regardless of patching availability and gives you a clearer view of the potential impact of an attack from APT groups.

Modular, scalable security for industrial environments

Organizations need flexibility when it comes to OT security, some want a fully integrated IT-OT security stack, while others prefer a segregated approach due to compliance or operational concerns. The Darktrace ActiveAI Security Platform offers integrated security across multiple domains, allowing flexibility and unification across IT and OT security. The platform combines telemetry from all areas of your digital estate to detect and respond to threats, including OT, network, cloud, email, and user identities.

Omdia recognizes Darktrace’s expansive coverage across multiple domains as a key reason why organizations should consider Darktrace / OT:

“Darktrace’s modular and platform, approach offer’s integrated security across multiple domains. It offers the option of Darktrace / OT as a separate platform product for those that want to segregate IT and OT cybersecurity or are not yet in a position to secure both domains in tandem. The deployment of Darktrace’s platform is flexible—with nine different deployment options, including physical on-premises, virtual, cloud, and hybrid.” (1)

With flexible deployment options, Darktrace offers security teams the ability to choose a model that works best for their organization, ensuring that security doesn’t have to be a “one-size-fits-all” approach.

Conclusion: Why Darktrace / OT stands out in Omdia’s evaluation

Omdia’s 2025 Market Radar for OT Cybersecurity Platforms provides a technical-first, vendor-agnostic evaluation, offering critical insights for organizations looking to strengthen their OT security posture. Darktrace’s recognition as a Market Leader reinforces its unique AI-driven approach, flexible deployment options, and advanced risk management capabilities as key differentiators in an evolving threat landscape.

By leveraging Self-Learning AI, autonomous response, and real-world risk analysis, Darktrace / OT enables organizations to detect, investigate, and mitigate threats before they escalate, without compromising operational uptime.

Read the full report here!

References

  1. www.darktrace.com/resources/darktrace-named-a-market-leader-in-the-2025-omdia-market-radar-for-ot-cybersecurity-platforms
Continue reading
About the author
Pallavi Singh
Product Marketing Manager, OT Security & Compliance

Blog

/

Cloud

/

April 2, 2025

Fusing Vulnerability and Threat Data: Enhancing the Depth of Attack Analysis

Default blog imageDefault blog image

Cado Security, recently acquired by Darktrace, is excited to announce a significant enhancement to its data collection capabilities, with the addition of a vulnerability discovery feature for Linux-based cloud resources. According to Darktrace’s Annual Threat Report 2024, the most significant campaigns observed in 2024 involved the ongoing exploitation of significant vulnerabilities in internet-facing systems. Cado’s new vulnerability discovery capability further deepens its ability to provide extensive context to security teams, enabling them to make informed decisions about threats, faster than ever.

Deep context to accelerate understanding and remediation

Context is critical when understanding the circumstances surrounding a threat. It can also take many forms – alert data, telemetry, file content, business context (for example asset criticality, core function of the resource), and risk context, such as open vulnerabilities.

When performing an investigation, it is common practice to understand the risk profile of the resource impacted, specifically determining open vulnerabilities and how they may relate to the threat. For example, if an analyst is triaging an alert related to an internet-facing Webserver running Apache, it would greatly benefit the analyst to understand open vulnerabilities in the Apache version that is running, if any of them are exploitable, whether a fix is available, etc. This dataset also serves as an invaluable source when developing a remediation plan, identifying specific vulnerabilities to be prioritised for patching.

Data acquisition in Cado

Cado is the only platform with the ability to perform full forensic captures as well as utilize instant triage collection methods, which is why fusing host-based artifact data with vulnerability data is such an exciting and compelling development.

The vulnerability discovery feature can be run as part of an acquisition – full or triage – as well as independently using a fast ‘Scan only’ mode.

Figure 1: A fast vulnerability scan being performed on the acquired evidence

Once the acquisition has completed, the user will have access to a ‘Vulnerabilities’ table within their investigation, where they are able to view and filter open vulnerabilities (by Severity, CVE ID, Resource, and other properties), as well as pivot to the full Event Timeline. In the Event Timeline, the user will be able to identify whether there is any malicious, suspicious or other interesting activity surrounding the vulnerable package, given the unified timeline presents a complete chronological dataset of all evidence and context collected.

Figure 2: Vulnerabilities discovered on the acquired evidence
Figure 3: Pivot from the Vulnerabilities table to the Event Timeline provides an in-depth view of file and process data associated with the vulnerable package selected. In this example, Apache2.

Future work

In the coming months, we’ll be releasing initial versions of highly anticipated integrations between Cado and Darktrace, including the ability to ingest Darktrace / CLOUD alerts which will automatically trigger a forensic capture (as well as a vulnerability discovery) of the impacted assets.

To learn more about how Cado and Darktrace will combine forces, request a demo today.

Continue reading
About the author
Paul Bottomley
Director of Product Management, Cado
Your data. Our AI.
Elevate your network security with Darktrace AI