VBSpam Q3 2026 Shows Why Authenticated Email Is Not Proof of Safety

Phishing defenses cannot treat a technically authenticated email as inherently trustworthy. Reporting on Virus Bulletin’s Q3 2026 VBSpam comparative test describes campaigns that combined apparently legitimate sending infrastructure with multi-stage, browser-aware URL cloaking—moving the malicious behavior beyond what a basic sender or static-link check can reveal. The test ran for 16 days under an AMTSO test plan and assessed 103,969 emails, including 103,380 spam messages. 13

The central finding: authentication can be legitimate and the message can still be malicious

SPF, DKIM and DMARC help validate aspects of a message’s sending path and domain alignment. They do not establish that an email’s content is benign, that every link is safe, or that the final page reached after a redirect chain is legitimate.

That distinction is central to the campaigns described in reporting on the test. Attackers used authenticated or trusted-looking infrastructure, then deferred the harmful action to a web flow that could inspect a visitor’s browser, location or timing before presenting a destination. 35

Three phishing patterns highlighted in the test reporting

1. An Amazon SES-delivered overdue-payment lure

One German-language campaign used an overdue-payment theme and was sent through Amazon SES from a DKIM-aligned domain. Rather than relying on an attachment, the HTML email reportedly included decoy markup, hidden text, a zero-size iframe and obfuscated JavaScript. 35

The linked flow was designed to evaluate the visitor: it fingerprinted browser and timezone information, made a concealed POST request, and redirected qualifying visitors to OpenSea. That sequence was reported as consistent with cloaked cryptocurrency or NFT fraud, while making simple inspection of the initial message or URL less revealing. 35

2. Fake McAfee and TotalAV subscription renewals

A Dutch-language campaign impersonated McAfee and TotalAV, warning recipients about “631 dangerous viruses” and promoting a discounted renewal. The lure used HTML-only social engineering rather than a conventional malicious attachment. 35

Its key evasive property was conditional delivery: the destination could change according to time, location or the apparent victim profile. This makes automated scanning harder because a scanner may receive a harmless page, an error, or a different redirect path from the one shown to a targeted recipient. The reported objective was subscription fraud. 35

3. A BCR S.A. PSD2-consent impersonation

A Romanian-language phishing message impersonated BCR S.A. and claimed that PSD2 consent required renewal. Reporting on the campaign says the destination was obscured with an IPv6-mapped address, an obfuscation technique that can complicate URL parsing and scanner analysis. 3

The apparent theme—mandatory banking-consent renewal—is suited to credential theft because it pressures a recipient to act quickly in a familiar financial workflow. 3

Why static scanning alone is under pressure

These examples point to a shift in where phishing logic lives. The initial email may contain a sender that passes authentication and a link whose intent is not immediately obvious. The decisive behavior occurs later, in the browser:

• HTML and JavaScript obscure the initial message structure.
• Redirect chains separate the delivered URL from the final destination.
• Browser, timezone, location and timing checks can distinguish a likely target from an automated system.
• Conditional responses can keep the most harmful content away from simple sandboxing or reputation checks. 35

For defenders, the implication is not to discard email authentication. It is to treat authentication as one input within a broader assessment of message content, sender reputation, link behavior and destination risk. 35

Defensive priorities from the findings

A stronger email-security workflow needs to inspect the full path, not just the first signal:

1. Normalize obfuscated URLs. Decode and canonicalize unusual address forms before applying reputation or policy checks.
2. Trace complete redirect chains. Evaluate every hop and the eventual landing destination rather than only the original link.
3. Analyze browser-side behavior. Detect conditional redirects, fingerprinting, concealed requests and other behavior that may only appear after page execution.
4. Keep authentication in context. SPF, DKIM and DMARC can support trust decisions, but should not override malicious-content or destination signals.
5. Measure false positives alongside detection. A product that blocks threats but disrupts legitimate mail creates a different operational risk. 35

Reported product results show a large spread

The reported composite results suggest that very high overall detection was achievable among the strongest products, but performance was not uniform. Net at Work NoSpamProxy recorded a 99.995 final score with no false positives; Bitdefender GravityZone Premium scored 99.994; and SEPPmail.cloudfilter scored 99.985. Rspamd was reported at 62.5%. 35

Those figures should be read as results from this specific comparative test, not as a universal guarantee for any environment. Still, the gap reinforces the practical lesson: handling authenticated senders, obfuscated URLs and conditional browser flows requires layered inspection rather than dependence on a single control. 135

Bottom line

The Q3 2026 VBSpam reporting illustrates a phishing model built around a simple asymmetry: attackers can make the email look acceptable at delivery time, then reveal the fraud only after the recipient’s browser meets selected conditions. Sender authentication remains necessary infrastructure hygiene—but the security decision must extend through the full redirect chain and final web experience. 35