The Adobe Sign Lure That Passed Every Auth Check

An email landed in the inbox of a project manager at a large engineering and environmental-consulting firm. It carried Adobe Sign branding, named the firm by its real company name, and asked the reader to download and review a signed agreement. It also passed SPF, DKIM, and DMARC cleanly, with a compound authentication score of 100. Every server-level check a modern mail stack runs came back green.

It was phishing anyway.

The lever was not a spoof. It was Amazon Simple Email Service (SES) and a real, privacy-protected business domain the attacker had wired into it.

Authentication proved control, not legitimacy

The message was sent through Amazon SES using a legitimate third-party domain as its sending identity. Because SES signs outbound mail for whatever domain an account has verified and configured, the message earned a valid DKIM signature aligned to that domain, an SPF pass on the SES sending IP, and a DMARC pass on the header From. compauth landed at 100.

Read that carefully, because the distinction is the whole case. DKIM alignment tells you a message was signed by a party who controls the sending domain's DNS. It does not tell you the message is legitimate for the person receiving it, and it says nothing about the brand splashed across the body. Authentication is a proof of domain control, not a proof of intent. When an attacker configures SES against a domain they have taken over or quietly stood up under privacy protection, the resulting mail is technically flawless and semantically fraudulent at the same time.

The sending domain was a first-time, external sender to this recipient, with WHOIS masked behind a privacy service. Those are risk signals, but none of them show up in an SPF, DKIM, or DMARC verdict. Only one automated signal dissented: the antispam engine assigned a spam confidence level of 5, flagging the message on content and behavior even as authentication waved it through. That gap, clean auth sitting over suspicious content, is the tell.

The four-hop laundry

The body impersonated Adobe Sign and personalized the pitch with the target firm's actual name, then offered a single call to action: Download PDF. There was no attachment. The button was a link, and the link did not go anywhere obvious.

It went through a chain. The first hop was link.edgepilot[.]com, a legitimate email link-protection service. From there it bounced to linkprotect.cudasvc[.]com, Barracuda's link-protection wrapper, and then into a Trend Micro clicktime redirector. Three separate security-vendor rewriting services, stacked back to back, before the click ever reached its destination.

That destination was an object sitting in an Amazon S3 bucket in the ap-southeast-1 region, with a long, non-descriptive alphanumeric filename and no tie to Adobe or to the impersonated firm. The displayed filename implied an agreement PDF. The actual object was a remote file on third-party storage, primed to present a sign-in prompt or stage a payload.

The stacking is deliberate. Each redirector is a trusted domain that URL-reputation scanners are inclined to wave through, so the final URL inherits the reputation of the security tools sitting in front of it. Static link inspection that stops at the first or second hop sees only known-good vendor domains. The real page, the credential-harvesting target, stays hidden behind the chain until a human clicks all the way through it. Several scanners in the incident record rated the intermediate links and the S3 object as clean for exactly this reason.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft lines up with a few techniques in the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery: a socially engineered message whose payload is a link, routed through wrappers to a cloud-hosted page.
• T1204.001 User Execution: Malicious Link covers the single Download PDF click the whole campaign depends on.
• T1656 Impersonation covers the Adobe Sign branding and the recipient's own employer name, both used to manufacture legitimacy.

Indicators of Compromise

Detection and what to watch for

Signature and reputation checks were always going to struggle here. The sending infrastructure is legitimate, the redirectors are legitimate, the cloud host is legitimate, and there is no attachment or malware to fingerprint. Detection has to shift to behavior and relationship. The signals that matter are a first-time external sender presenting a signed-agreement pretext, a brand claimed in the body that has no tie to the authenticated sending domain, and a call to action that redirects through multiple wrappers before resolving to obfuscated cloud storage.

This is where IRONSCALES adds a layer static gateways miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, reads the relationship between the claimed brand, the actual sending domain, and the redirect chain the way a trained analyst would, flagging the impersonation even when every server-level check comes back clean. That behavioral read is drawn from patterns across 35,000+ security professionals at 17,000+ organizations. The 2024 Verizon Data Breach Investigations Report puts phishing in 15 percent of breaches and the human element in 68 percent, and the Microsoft Digital Defense Report 2024 documents the same pivot toward abusing trusted cloud services rather than breaking them. The FBI's 2023 Internet Crime Report ranks business-identity impersonation among the costliest fraud categories, which is precisely the trust this campaign borrowed.

The takeaway

A green authentication result is a statement about plumbing, not about honesty. SPF, DKIM, and DMARC confirm that a message traveled through configured infrastructure and was signed by someone who controls a domain. They cannot tell you whether that someone is the brand on the letterhead or a stranger who verified a domain in SES an hour ago. When the auth stack says pass and the content says sign this urgent agreement from a sender you have never heard of, the content is the more honest witness. Pair that instinct with behavioral detection that inspects the full redirect chain, and you close the gap this attack was built to slip through.

CISA's guidance on recognizing and stopping phishing early is a useful reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one