A Subscription Confirmation You Never Requested Is Reaching Your Staff

A wave of unsolicited subscription confirmation emails is landing in NZ inboxes, posing a quiet but meaningful risk to your organisation. These messages are designed to normalise contact from an unknown sender, establishing a foothold for follow-on phishing, credential harvesting, or malicious link delivery. Even without an obvious payload in the initial message, the act of engaging — clicking unsubscribe, managing preferences, or simply replying — can confirm an active address to threat actors and trigger escalating contact.

A spike in matching messages has been detected across multiple local organisations within a narrow window, indicating a coordinated distribution effort rather than isolated noise. The campaign spread across several unrelated environments in a single day, suggesting automated bulk sending infrastructure targeting NZ-based recipients broadly rather than any single sector or organisation type.

What makes this campaign particularly deceptive is the authentication posture it presents. DKIM, DMARC, and composite authentication checks all return passing verdicts, meaning many email security controls will treat these messages as legitimate. The sender address, however, tells a different story — it routes through a free-tier HubSpot sending domain and encodes a mismatched French domain within the address itself, a pattern inconsistent with any genuine subscription service your staff would recognise or have enrolled in.

The physical address embedded in the email footer references a Stockholm street address, lending a veneer of regulatory compliance typical of legitimate marketing emails under GDPR requirements. The greeting uses a garbled placeholder string rather than a real name, suggesting the personalisation tokens in the sending template failed or were deliberately left malformed — a hallmark of hastily assembled bulk campaigns. The unsubscribe link resolves to a HubSpot free-tier preference centre subdomain, which, if clicked, confirms deliverability and recipient engagement to whoever controls the sending account.