Craig McDonald

CEO & founder @MailGuard. #Cybersecurity expert. Passionate about cloud & email security.
Author: Surviving the Rise of Cybercrime (free download below)

[Craig McDonald @CraigEMcDonald]

Your credit card gets “limited.” Payments stop. Subscriptions fail. Someone in finance drops everything to fix it. That urgency is what attackers are counting on. We’re seeing a new Amex scam that plays directly into this pressure.

Read about it here: https://t.co/BuhKyuWG9V

[Craig McDonald @CraigEMcDonald]

A refund dispute lands in your inbox. It looks routine, feels operational. Someone in finance clicks, reviews it, and tries to resolve it. This is what we’re seeing in a new QuickBooks phishing campaign targeting businesses right now.

Read more here: https://t.co/UGl9jzR0Zn

[Craig McDonald @CraigEMcDonald]

A $2.90 delivery fee doesn’t feel like a cyber risk, it feels routine, but that’s exactly why it works. We’re intercepting a new Australia Post phishing campaign designed to look like a standard shipping update.

Get the breakdown here: https://t.co/Ac2mckKpDe

[Craig McDonald @CraigEMcDonald]

Caution your team, we’re intercepting a new campaign targeting Australians, impersonating myGov, and using a multi-step process to harvest their credentials and personal information.

You can get the full breakdown here: https://t.co/leTl3GTiUt

[Craig McDonald @CraigEMcDonald]

We’re intercepting a new scam that’s impersonating Anthropic, using Claude branding to push users into entering credit card details. It feels legitimate because it mirrors the tools people are already using every day.

Get the breakdown here: https://t.co/PKvnMYwxn2

[Craig McDonald @CraigEMcDonald]

Tell your teams to be careful about Spotify payment notifications. We’re blocking a new phishing campaign impersonating Spotify, that takes users through a multi-step process, login, payment details, then personal information.

Get a full breakdown here: https://t.co/1maBlCdBGn

[Craig McDonald @CraigEMcDonald]

We’re seeing a rise in toll road scams impersonating Linkt, targeting Australian drivers and businesses with messages that look completely legitimate.

Read about it here: https://t.co/6xUnzsde7J

[Craig McDonald @CraigEMcDonald]

A small payment request can feel routine, alerting your team to a shipment delay. A customs fee to be sorted and a quick approval to keep things moving. We’re seeing this play out in a current campaign impersonating DHL right now.

Here's a breakdown:
https://t.co/VH2MwpVUmf

[Craig McDonald @CraigEMcDonald]

A message from Medicare shouldn’t be a risk, but that’s what attackers are exploiting. A simple email with a routine prompt to “check your inbox.”

We're stopping a Medicare impersonation campaign doing exactly this, to steal your myGov info.

Read more: https://t.co/Qw6Z8Ru4my

[Craig McDonald @CraigEMcDonald]

We’re now intercepting campaigns that replicate entire Microsoft 365 customer journeys, not just login pages. Multi-step flows designed to build trust, not break it.

You can get the breakdown here: https://t.co/0G019I887j

[Craig McDonald @CraigEMcDonald]

This latest phishing campaign impersonates CMC Markets, using a “Regulatory Security Notice” to create urgency and trust, then quietly capturing user login credentials through a fake site.

Here’s a breakdown of how this particular scam works: https://t.co/0LpHpaqrx6

[Craig McDonald @CraigEMcDonald]

A healthcare admin’s email account was compromised and used to send a PDF to partners & patients of the medical specialist group she represents. The PDF link leads to a fake Microsoft login page designed to steal user's MS365 credentials.

Read more 👇
https://t.co/DRY3MK7efH

[Craig McDonald @CraigEMcDonald]

We’re currently stopping phishing emails impersonating Vodien domain renewal notices, pushing recipients to a fake payment page designed to capture credit card details.

Stay safe. Read more here: https://t.co/M6Db8QLLPo

[Craig McDonald @CraigEMcDonald]

Most cyber attacks start with something that looks routine. Like a training document, policy update, or a “learning path” someone needs to complete before a deadline. That’s what a new phishing campaign we’re stopping is exploiting.

Read about it here: https://t.co/otAwhkN1Dh

[Craig McDonald @CraigEMcDonald]

A Spotify-themed scam email places the login and payment details of team members in jeopardy. MailGuard’s AI threat engines have intercepted the emails that present a fake login, account suspension, and credit card capture page.

Read more here:
https://t.co/5UyP6HMhx3

[Craig McDonald @CraigEMcDonald]

A toll notice shouldn’t become a security incident, but that’s what we’re seeing. An “Overdue Final Toll Invoice” email, branded as Linkt with an urgent tone, a familiar format and delivered as one large image with a button to pay now.

Read more: https://t.co/wfnMc5JLQr

[Craig McDonald @CraigEMcDonald]

A government logo lowers your guard, especially with a household name like Medicare. That’s exactly why attackers use it. A new “Important reminder” email impersonating Medicare, is luring recipients to a fake myGov sign-in page.

Read more here: https://t.co/y85Lkxgjwi

[Craig McDonald @CraigEMcDonald]

Warn your team to take care with AusPost delivery notifications. MailGuard’s AI-powered threat engines are stopping an Australia Post phishing campaign using a simple “Parcel Awaiting Instructions” email to steal your credentials.

Read more here: https://t.co/BubIKXY9Jx

[Craig McDonald @CraigEMcDonald]

Tell your teams to be alert for a ‘renewal scam’ impersonating ‘CrazyDomains’. It warns of a service interruption and lands when teams are busy & distracted, capturing credit card details, SMS codes, and even PINs.

Read more here: https://t.co/ugFCMSRfKL

[Craig McDonald @CraigEMcDonald]

Alert your teams to this latest EnergyAustralia refund scam, because most phishing doesn’t look dangerous anymore, it looks helpful. We’ve published a short breakdown of why it’s effective & what leaders should be paying attention to.

Read it here: https://t.co/y9hkzRaVCV