Avoid the Ragebait. Phishing Emails Exploit Anger Over ICE to Trick Users

Phishing emails often use fake free offers or security alerts to trick you into clicking. But a new attack is exploiting public anger against US Immigration and Customs Enforcement (ICE).

On Friday, Simo Kohonen, founder of cybersecurity provider Defused, spotted the scam in a email he received, calling it, "Ragebait as a phishing tactic."

The email impersonated Sendgrid , a platform used to send bulk emails, and claimed that the email marketing firm would publicly back the US government agency.

“As part of our commitment to supporting US Immigration and Customs Enforcement (ICE), we will be adding a ‘Support ICE’ donation button to the footer of every email sent through our platform,” the phishing email says. “This button will appear automatically in all outgoing emails starting week.”

The email then offers recipients a way to opt-out by clicking a button that supposedly forwards the user to Sendgrid’s account settings. However, Kohonen realized the email was fake since it came from an unofficial, possibly hacked web domain.

“The sending domain was theraoffice[.]com, which seems to be a legitimate small business, so I suspect Theraoffice's Sendgrid credentials were compromised and used to send these phishing mails,” he tells PCMag.

The email’s ultimate aim is unclear. Kohonen tried to investigate by clicking the link in the message, but it had already expired, leading to a blank page. However, Kohonen notes that he’s been receiving phishing emails impersonating Sendgrid for at least six months now, and says the earlier attacks tried to steal Sendgrid credentials by serving up a fake login page.

This comes as US protests against ICE have become more intense after an ICE officer shot and killed a 37-year-old woman in Minnesota. As a result, the ragebait tactic might work on some unsuspecting users opposed to ICE. It's a reminder to be careful with unexpected emails. Double-check the source and authenticity of the messages, especially those that trigger a strong emotional response.

Sendgrid and the company behind the Theraoffice domain didn't immediately respond to a request for .