Manufacturing Phishing Teardowns

Every Attack of the Day teardown where the targeted organization was in manufacturing, newest first. Real attacks on manufacturers, dissected: the headers, the lure, and why it got past the first line of defense. Targeted organizations are never named.

All teardownsEducationHealthcareFilter in the ExplorerManufacturing email security

2026

• A Phishing Kit Padded Its Payload With Someone Else's Mail2026-09-04
• The Whole Page Is the Button: A PDF Click Trap2026-08-03
• Two-Stage Bank Scam Splits the Link to Starve Scanners2026-07-29
• The PDF That Scanned Clean Because Nobody Could Read It2026-07-27
• The PayPal Scam That Emailed You Your Own Password2026-07-20
• Three Brands, One Lure: A Chase 'Secure Message via Virtru' That Actually Came From LinkedIn2026-07-17
• The Compliance Notice That Borrowed the Government's Words and the Carrier's Own DOT Number2026-07-09
• The File Format Your Gateway Forgot: EPS Macros Hidden in a Logo ZIP2026-07-04
• The Payroll Memo Whose Link You Could Not Scan: QR Code Quishing Buried in a Word Attachment2026-07-03
• Seized and Still Dangerous: IP-Literal Download Link, Netlify Credential Page, and a VIP Target2026-06-29
• A Construction Bid Invitation Hid a Compromised Website Behind a Legitimate-Looking PDF Label2026-06-26
• A Fake Scotiabank Voicemail Was Actually an HTML File Asking You to Call an Attacker2026-06-22
• The Law Firm Document That Linked to a Cleaning Company2026-06-18
• The Invoice Portal Link That Didn't Need a Password2026-06-17
• The Invoice Email With No Text to Scan: Image-Only Payload From a Compromised Account With a Broken ARC Chain2026-06-10
• The Password Reset That Came From an Auth0 Dev Tenant2026-05-22
• The Warranty Form With a Windows Executable Hidden Inside a GIF2026-05-21
• The Spreadsheet With No Macros and One Hidden Link: External Relationships in Office XML2026-05-13
• Perfect Authentication, Zero Payload: The Yahoo Free-Mail BEC That Microsoft Flagged but Didn't Block2026-05-09
• The Government Email That Authenticated Itself After Transit2026-05-08
• Insurance Claim PDF Hides JavaScript Behind AcroForm Fields and SendGrid Redirects2026-05-01
• Sign Here, Get Phished: Inside an Adobe Sign Lure With a Multi-Hop Redirect to Credential Theft2026-04-22
• One Missing Letter, One Stolen Payment: A Reply-To Typosquat That Beat the Spam Score2026-04-21
• The URL That Put adobe.com in the Wrong Place2026-04-20
• The Button Text Was the Weapon: Unicode RTL Obfuscation Inside a DocuSign Lure2026-04-05
• When the Safety Wrapper Becomes the Disguise: Brazilian NF-e Phishing via Safe Links Rewrite2026-04-03
• The FedEx Email Was Real, the PDF Was an Image, and the Sandbox Saw Nothing2026-03-23
• SafeLinks Wrapped the Phishing URL With the Recipient's Name on It2026-02-27
• Hyundai Card HTML Attachment Harvests Credentials Without a Single Malicious URL2026-02-19
• The Auth0 Developer Tenant That Passed Every Security Check (Because It Was Real)2026-02-18
• Encrypted PDF Invoice Drops Through SPF, DKIM, and DMARC on a 6-Day-Old Domain2026-02-09
• A Fake Microsoft Quarantine Notice Rode a Hijacked Business Thread Through Amazon SES2026-02-06
• When the Password Reset Comes From a Fortune 500 Logistics Giant2026-02-01
• Microsoft's Own Domain, Your Attacker's Form: How forms.cloud.microsoft Became a Credential Harvest Host2026-01-30
• Seven Days Old, Port 8443: The Throwaway Domain That Safe Links Couldn't Stop2026-01-29
• A False Positive Worth Studying: Why Behavioural Detection Fired on a Legitimate Email2026-01-23
• A Pixel-Perfect Sephora Delivery Notice Shows Why Email Authentication Alone Can't Protect You2026-01-15

2025

• The Wire Transfer Confirmation That Had No Body, No Links, and Full Authentication2025-12-31
• The DKIM Key That Was Too Small to Verify: When Cryptographic Weakness Becomes a Detection Gap2025-12-28
• The Marketing Email That Forgot to Fill In Its Own Template2025-12-23
• Three Brands, Zero Connection: A Saudi Football Club, a Healthcare Vendor, and a Business Advisory Firm Walk Into Your Inbox2025-12-10
• Authenticated Dutch Email from WBG Pooling Carries Undecodable Barcode in Signature Image2025-12-04
• Taulia Supplier Portal Impersonation with Footer Address Mismatch via Amazon SES2025-12-02
• Hidden in Plain Sight: Executables Buried Inside a JPEG and a 1KB ZIP2025-11-17
• A Phishing Lure Hiding Inside a Real Microsoft Verification Email2025-11-13
• Three Domains, One Scam: The RFQ That Routed Replies to a Freshly Built Lookalike2025-11-10
• The Proposal Button Nobody Could Inspect2025-10-31
• The JPEG That Kept Going After the Image Ended2025-10-26
• The Verizon Rewards Email with a Kitchen Drawer Stuck in the Middle2025-10-25
• The Email Was Real. The Workspace Was the Weapon. An Asana Invite Claimed to Be From Meta.2025-10-13
• The 454 KB HTML Attachment That Pretended to Be an Outlook Inbox2025-10-11
• The Fake PayPal Charge That Needed You to Read Your Own Login Code Out Loud2025-10-09
• Three Brand Names, One Payment Email, and a PDF That Lied About What It Was2025-10-08
• Four PE Executables Hidden Inside an OLE Container Disguised as a CAD Drawing, Sent From Inside the Organization2025-10-04
• The Google Calendar Invite That Charged $316.66 to a Brand That Didn't Send It2025-10-02
• The Shipping Notice That Hid a Windows Executable Inside a PNG2025-09-13
• Oracle Email Delivery Sends the Phish: Authenticated Invoice Lure via NetSuite Infrastructure2025-09-06
• Zero-Link 'Reply YES' Scam Uses Hotmail to Bypass Every Payload Scanner2025-08-30
• Purchase Order PDF With Embedded Image Bypasses Static Analysis From Authenticated Sender2025-08-26
• Malicious PDF Proposal Hides Behind Authenticated Vendor Infrastructure and Four Words2025-08-25
• The Invoice Was an Image. The Body Was Two Words. The Authentication Was Perfect.2025-08-13
• Full Authentication, a Three-Week-Old Domain, and a Link Flagged Malicious2025-08-07
• Hiding Inside the Security Stack: How a Redirect Chain Used Trusted URL-Rewriters to Deliver a Throwaway Domain2025-08-03
• The W-9 Request That Proved Itself: How a Click-Tracker PDF Targeted One Accounts-Payable Recipient2025-07-30
• DocuSign Lure, Compromised WordPress Endpoint: When the CTA Goes Nowhere DocuSign Would Ever Send You2025-07-20
• Three Domains, One Fake Invoice: The Pact Group Payment Confirmation Lure2025-07-14
• Construction Plan Room Impersonation: Amazon SES Authentication Passes While the CTA Routes to nasr.org.uk2025-07-03
• HPI Brand Impersonation Uses Authenticated-but-Unrelated Amazon SES Sender and Three-Hop Redirect Chain2025-06-18
• Free Hotmail, Fake Adobe: How a Relocation Lure Hid a Throwaway Credential-Harvest Domain2025-06-12
• MSC Brand Impersonation Abuses a Legitimate Open Redirector and Base64-Encodes the Victim's Address for Targeted Tracking2025-06-09
• Trusted Vendor, Attacker's Form: How a Compromised Lab Account Delivered a Zoho Credential Harvest2025-05-31
• Image-Only Invoice Fraud: How Attackers Hide Mule Bank Accounts from Every Text Scanner2025-05-29
• No Links, No Malware, Just a Phone Number: Geek Squad TOAD Invoice Targets an Engineering Manager2025-05-26
• Finance Director's Name, Stranger's Domain: VIP Display-Name BEC Targets Accounts Receivable Data2025-05-24
• Compromised Vendor M365 Account Issues Fraudulent Banking-Change Instructions Across Four Mailboxes2025-05-22
• Price Revision as the Hook: How a Mirror Site Without TLS Impersonates an Industrial Supplier2025-05-14
• PE Executable Concealed in a JPEG, Nested Inside an RFC822 Email: The COSCO Bill-of-Lading Lure2025-05-11
• Luxury Brand Bait: How Mandrill, Safe Links, and a Fake Display URL Combined to Hide a Credential Harvest2025-05-10
• When Amazon SES Carries the Malware: HR Impersonation and a Confirmed-Malicious PDF2025-04-29
• Dairy Brand, IRS PDF, Stolen Credentials: How ESP Abuse Launders Phishing Trust2025-04-26
• No Link, No Compromised Account, No Problem: How a Personal Outlook Address Delivered a Boleto Fraud2025-04-19
• Your Own IT Department, Forged: BOM Encoding and a Medium Open-Redirect Hide a Vercel Credential-Harvest Portal2025-04-17
• Dressed as Microsoft Forms, Pointing Somewhere Else: How a Single Wrapped CTA Hid Behind a Page Full of Legitimate Links2025-04-15
• One Day Old, Fully Authenticated: How a Fresh Attacker Domain Passed Every Check and Delivered a Fraudulent Boleto2025-04-05
• Real Brand Trackers as Cover: A Boot Barn and DocuSign Impersonation That Routed One Malicious Link Through a Field of Legitimate Ones2025-04-04
• The Netflix Billing Alert That Every Scanner Blessed (One Header Told the Truth)2025-03-31
• When the Link Has Nothing to Do with the Brand: Nexi Impersonation via Throwaway Domain2025-03-29
• This Phish Wanted Your LINE QR Code, Not Your Password2025-03-20
• They Hijacked a Real Thread to Hide a Google Redirect2025-03-18
• The $0.01 Email That Was an Account-Fraud Dry Run2025-03-17
• The FedEx Invoice Your Scanner Couldn't Read on Purpose2025-03-16
• A Real Zoom Alert With Fraud Text Grafted Into It2025-03-09
• A Free Trial Bought Them a Perfect Sending Identity2025-03-03
• The Authenticated Email That Only Wanted a Contact List2025-02-23
• Nothing to Block: Real DocHub, Fake QuickBooks Branding2025-02-12
• A Month-Old Domain With Perfectly Clean Authentication2025-02-11
• A 64-Bit Password, Handed Over in the Same Email2025-02-07
• The Phishing Link That Was Only an Image2025-02-02
• Perfect Authentication, Invented Conversation2025-02-01
• Fake HubSpot Partner Invoice, Recycled Phishing Kit2025-01-31
• Spoofed LinkedIn Alert Rides an ARC Seal Past DMARC2025-01-24
• SPF-Passed Email Carried an $80K Fake Vendor Invoice2025-01-23
• Own-Domain Spoof Fails SPF, DKIM, and DMARC, Still Delivers2025-01-10
• QuickBooks Display Name, LinkedIn Envelope2025-01-09
• The Share Button Looked Real. The Domain Didn't.2025-01-06

2024

• Europol Doesn't Email You a Screenshot2024-12-31
• The Credential Form Lived on a No-Code Automation Platform2024-12-30
• Failed Every Auth Check, Then Rode Google's Links to S32024-12-27
• The Scam That Couldn't Spell the Name It Impersonated2024-12-25
• Invisible Letters Hid a Mailbox Verification Phish2024-12-13
• The Zero-Width Trick Inside a Fake Microsoft 365 Bill2024-12-12
• The Fake Webroot Renewal Hiding in a Calendar Invite2024-12-09
• The Gmail That Namedropped the CEO for a Phone Number2024-11-29
• DMARC Said Reject. The Real Account Sent It Anyway.2024-11-28
• The Verified FedEx Email That Wanted Your Documents2024-11-27
• A $27M Funding Pitch From a Trust That Doesn't Exist2024-11-25
• The PayPal Invoice Was Real. The Fraud Was Not.2024-11-20
• A Real Gmail, a Real Drive Link, a Fake Tax Form2024-11-19
• The Bank Authorization Lure Amazon SES Waved Through2024-11-10
• A Fake DocuSign Request Bolted to a Parking Thread2024-11-09
• SharePoint Renewal Lure Rides a Real Security Gateway2024-11-01
• The One PayPal Link That Dropped to Plain HTTP2024-10-30
• An Attachment Named Like the Microsoft 365 Admin Center2024-10-24
• The SAM.gov 'Final Notice' That Never Touched a .gov2024-10-22
• The RFQ With No Sender and a Hijacked Reply Path2024-10-18
• DocuSign Kit So Reused It Left a Hearing-Aid Signature2024-10-13
• A Hijacked ISP Mailbox, a QR Code, and a Clean DKIM Pass2024-10-07
• A Hijacked 20-Year-Old Mailbox Delivers a Document Lure2024-10-01
• When a University Mailbox Peddles a Loan Scam2024-09-29
• A Real Datadog Report, a Fake Bill, One Phone Number2024-09-27
• The Brand Name Was in the Path, Not the Domain2024-09-26
• The Password Was in the Email, Highlighted in Yellow2024-09-21
• A Fake Government Newsletter and a 45-Minute-Old Domain2024-09-08
• When the Subject Line Is Your Own Name2024-09-03
• When the Sender Name Is Not Even the Same Alphabet2024-08-29
• A Refund Notice From the Wrong Industry2024-08-25
• A Company Impersonating Itself, From Someone Else's Mailbox2024-08-24
• The Fake McAfee Renewal Typed Into a Calendar Field2024-08-23
• The Union Benefits Domain That Was Seven Weeks Old2024-08-22
• The Receipt That Looked Like You Sent It to Yourself2024-08-14
• The Invoice Authenticated Cleanly for the Wrong Company2024-08-04
• Clean Attachment, Clean Link, and a Guessed DMARC Pass2024-08-01
• Sixteen Minutes Old: An E-Signature Lure With No Text2024-07-28
• The Trade Lead Whose Own Website Did Not Resolve2024-07-21
• One Invoice Email, Four Different Identities2024-07-13
• Three Hops Deep, Behind a Gate No Scanner Can Solve2024-07-10
• The Wrong Tax Form Broke a Flawless Vendor Email2024-07-01