Your mailbox is full - Analysis of phishing techniques using urgency messages

The Evolution of the Digital Environment and Cyber Attacks

In today's world, where the digital environment has become a part of everyday life, cyberattacks are evolving into sophisticated social engineering strategies that manipulate human psychology, beyond mere technical hacking. Recently, there has been a surge in phishing attacks impersonating corporate email services or overseas shipping notifications, focusing on undermining users' vigilance and prompting clicks by emphasizing a sense of 'urgency'.

Hidden Warning: Your mailbox is full

In the first half of 2025, phishing emails impersonating actual business email services such as Naver Works, Hiworks, and Microsoft 365 were widely distributed. These emails trigger user anxiety with warning messages like "Your mailbox is over quota" and "Delivery may be blocked," enticing them to click on a 'free up space' button. These phishing emails are not just clumsy scams they meticulously imitate the logos, colors, and fonts of real companies, using similar domain addresses to build trust. When users click the link, a login screen appears, and they unknowingly enter their information, leading to account theft or the installation of malware. Security experts highlight the psychological design hidden behind this visual sophistication, noting that it is not just a technical issue but an attack that precisely exploits human cognitive vulnerabilities.

Delivery delays? The truth is a psychological trap.

Recently, with the increase in international shopping through overseas direct purchases, there has been a noticeable rise in phishing incidents pretending to be international deliveries. Emails impersonating real shipping brands like DHL, FedEx, USPS, and UPS demand user action through messages such as 'Your shipment has arrived at customs' and 'Additional documents are required.' Clicking on the 'Submit customs documents' or 'Pay tax' buttons leads to fake websites, ultimately prompting users to enter personal and payment information. Smishing attacks operate in a similar manner. They send text messages notifying users of 'Delivery failure' or 'Unpaid fees' and provide a link, which, when clicked, is designed to install malicious apps. These techniques work more effectively when they align with the user's real-life experience—specifically, when they are actually waiting for a package. When an unidentified 'urgent message' arrives, users often resort to reflexive actions of 'let's check it out first' rather than making a rational decision.

Manipulation Strategies Targeting Psychology: The Psychological Weapon of 'Urgency'

The key factor in the success of phishing attacks is not technology, but psychology. In particular, 'urgency' is the most widely and effectively used strategy in social engineering attacks. When people encounter messages like 'Your email access will be blocked soon' or 'If you don't act now, additional charges will occur,' they are more likely to choose immediate action. Emotional pressures such as threats, losses, and time constraints combine to bypass logical decision-making processes. What is even more noteworthy is that those who believe they will 'never be deceived' can actually fall victim more easily. This 'overconfidence bias' clouds their vigilance and leads them to overlook situations that they would normally suspect. Phishing attackers have a keen understanding of these psychological vulnerabilities in humans.

Response and Prevention: The Double Defense of Technology and Awareness

To respond to phishing, both technical defenses and awareness improvement must be implemented together. First, links embedded in emails or text messages should not be clicked whenever possible, and you should develop a habit of accessing the official website directly through the browser. It is also important to verify whether the sender's email address matches the actual company domain. For example, Hiworks does not use any address other than 'hiworks.com', and DHL can confirm the authenticity of a shipment based on clearly provided tracking numbers. Additionally, implementing two-factor authentication and email security solutions, as well as conducting regular security training and phishing email simulation exercises at the organizational level, can enhance the response capabilities of members. If you receive a suspicious email, rather than opening it, the first step to reducing harm is to immediately report it to the Korea Internet & Security Agency (KISA), the Financial Security Institute, or the customer service of the relevant company, and delete it.

Conclusion: Always doubt once more

Today, phishing attacks are not just simple technical scams they are sophisticated psychological warfare that targets predictable gaps in human behavior. They use 'urgency' as a weapon to paralyze our judgment and make us hand over information willingly. The most dangerous thought is the conviction that 'I would never fall for something like that.' It is exactly this gap that attackers exploit. Therefore, we must remember. When we open an email or receive a notification—take a moment, and be sure to question once more. That brief moment of doubt is, in fact, the most powerful shield we can use to protect ourselves in the digital age.