One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we attach the manager as CCd in the headers but never actually send the CC email using our server, making it look like the manager is aware and approves, while the real manager has never actually received the email. However what we're finding an issue with is how do we actually fix this problem? Does a solution exist which checks the CCd users and whether they've actually received the emails? Is there any other way to detect this?

1 Answer 1


There is no way to detect this and there is no tool for this. You would need to actually check with the claimed recipient or at least with the log files of the mail server - the latter is not something a normal employee could do.

I think you need to adjust the processes instead, i.e. employees should not trust anything written in the body, any attachments, the subject or the Cc of the mails since these could all be arbitrary made up - similar to snail mail. From is a bit more reliable if DMARC together with DKIM/SPF is used but with only a bit of social tricks From can be made look trustable too even if DMARC is enabled.

  • Are you aware of any SMTP server that does those checks? That is a server which checks the mail logs automatically for any CCd users. I suppose that we could script it but oh boy would that be annoying. But yea educating the users is definitely a priority
    – trallgorm
    Commented Mar 23, 2019 at 18:10
  • @trallgorm: since the CC'ed users might belong to a completely different domain where the server has no access to one cannot create a mail server which does such checks. Commented Mar 23, 2019 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .