Marketers often use a tool called email tracking to monitor their marketing campaigns. According to Check Point Software, cybercriminals can also use this technology to map out networks they want to penetrate.

Email Tracking Explained

Marketers first came up with the idea of tracking pixels, also called web beacons and web bugs, that are initially embedded into messages or attachments. They load when a recipient opens an email.

The sender of the message can then receive information regarding many identifiers, including if an email has been opened, how many links are clicked, what platform the receiver uses and the status of the message. These details help marketers evaluate the efficacy of their campaigns.

One of the problems with tracking pixels is that most end users do not even realize they are being tracked in the first place. The pixel is usually disguised to look like part of an image. Marketers may think they are being subtle by not alerting users of the tracking, but bad actors can use the same technique to be sneaky.

Cybercriminals leverage various tactics to influence victims to spread fraudulent emails throughout their organizations. As a malicious message makes its way through the enterprise, it collects more data for fraudsters to track. This journey gives attackers an inside look at who is likely to open a fake email and what systems they use, enabling them to focus on particularly vulnerable targets.

Insecure by Default

Some browser programs allow enclosed email images to be automatically downloaded. If this is the default behavior, tracking pixels will slip right though any defenses. To protect themselves from this threat, users should set their browsers to request permission to download images.

Bleeping Computer noted that desktop email clients block images by default, giving users some control. Chrome extensions such as UglyEmail and PixelBlock can also stop images from loading by default.

This report offers yet another example of cybercriminals’ proclivity for repurposing legitimate tools for nefarious purposes. The only way to avoid becoming a target is to take control of email and browser settings, and be aware of possible avenues of attack.