A note on the indicators below: all hostnames and URLs in this post are defanged (
hxxps[:]//,[.]) so nothing in the page is clickable. Re-fang them only inside an isolated analysis environment. The detection rules in §9 are deliberately left in working form so they can be copied straight into a mail gateway or SIEM.
TL;DR
A client forwarded us a phishing email impersonating them. The payload URL pointed to adminmessagess.freshdesk[.]com (note the double “s”). One urlscan.io pivot later, we found 21 Freshdesk tenants all serving the same “New Secure Message From Admin” credential-harvest page, active May–August 2026.
The actor’s trick: register throwaway Freshdesk accounts with admin-themed names and abuse the platform’s own SSO login as the credential-capture page — no bespoke phishing kit required. In August 2026 the campaign evolved to add a JS-obfuscated Cloudflare Pages second-stage redirector.
This post walks the investigation from email to campaign.
1. The email that started it
A security team at a UK service forwarded us a phishing sample their staff had received. The email impersonated a different UK practice and used a classic “secure message / shared file” lure:
You have been sent a secure email.
Click here — linking to:
hxxps[:]//adminmessagess.freshdesk[.]com/en/support/solutions/articles/158000458571-new-secure-message-from-admin— by 07-23-2026 5:38 UTC-4 to view your message. After this date you must access the message via the attachment.
The red flags were immediate:
| Flag | Detail |
|---|---|
| Typosquat domain | adminmessagess.freshdesk[.]com — double “s” in adminmessagess. A legit Freshdesk subdomain would be adminmessages (single s) or just *.freshdesk[.]com. |
| Self-to-self sender | From == To == booby_miles@<redacted>[.]co[.]uk — classic spoofed-header blast. |
| Date contradiction | The email says “by 07-23-2026” but the email’s own Date header is 30 July 2026 — a week after the stated expiry. Stale kit template. |
| Mismatched hosting | The recipient organisation’s secure-file-share has no business living on a Freshdesk support portal named adminmessagess. |
The payload URL was the only phishing indicator. The rest of the .eml was the legitimate forwarding chain plus some unrelated newsletter content — we stripped that out before analysis.
2. The payload: a stock Freshdesk login page
We mirrored the payload URL (GET-only). The first surprise: it’s not a bespoke phishing kit. It’s a stock Freshdesk “visitor portal” SSO login page on a real Freshdesk tenant.