The Parcel Phish That Borrowed a Nonprofit's Reputation

A parcel notice reading Servicio de Paquetes landed in the mailbox of an inside account manager at a promotional-products distributor. It was in Spanish, it carried a tracking number, and it gave the reader 48 hours to confirm a delivery address or lose the shipment. None of that is unusual. What is unusual is that the message passed every authentication check a mail system can run, and it did so because it was sent from a real nonprofit's own sending credentials.

The composite authentication score came back at 100. SPF passed, both DKIM signatures passed, and DMARC passed. On paper, this was as clean as mail gets.

Borrowed Reputation, Not Broken Authentication

The sender was a legitimate community nonprofit whose Amazon SES sending credentials had been abused or compromised. Amazon Simple Email Service is a high-volume sending platform used by countless legitimate organizations, and when an attacker gets hold of a tenant's SES credentials, the mail they send inherits everything that domain has earned. SPF resolved to an authorized Amazon SES IP. DKIM carried valid signatures for both the nonprofit's domain and amazonses.com. DMARC aligned and passed with a policy action of none.

That is the whole trick. The attacker did not spoof a domain or forge a header. They sent from a domain that was genuinely allowed to send, so there was nothing for authentication to reject. This is the pattern the 2024 Verizon Data Breach Investigations Report keeps documenting, with stolen credentials sitting behind 38 percent of breaches as the single most common initial action. Once valid credentials are in play, the perimeter checks that most defenses lean on have already been satisfied.

A first-time external sender arriving with a perfect authentication pass should read as a contradiction, not a green light. Authentication answers the question of who sent the message. It says nothing about whether that sender should be trusted, and it says nothing at all when the real owner never sent it.

The Click Chain

The lure body was deliberately thin. A generic Estimado cliente greeting, no personalization, a fabricated tracking number, and a single button labeled Confirmar Direccion. The urgency deadline did the persuasion, and the button did the routing.

That button did not point at a delivery carrier. It first passed through an Amazon SES click-tracking redirector on the awstrack.me domain, then unwrapped to a landing domain that had been registered just two days before the message was sent. The landing domain sat behind a privacy shield that hid the registrant, and its only purpose was to collect the address and personal details the email asked for.

Stacking those two choices is what makes this campaign worth studying. The sending side leaned on established, fully authenticated infrastructure to defeat reputation and authentication filters. The destination side used a domain so new it had no reputation to score, which defeats age-based and history-based checks. One layer beats the filters that trust the familiar, the other beats the filters that distrust the unknown, and the redirect through legitimate AWS tracking infrastructure smooths the seam between them.

See Your Risk: Calculate how many threats your SEG is missing

Why This Beats Static Defenses

A gateway that keys on DMARC results was never going to stop this. The message did not fail an alignment check, it passed one. Reputation scoring on the sending domain worked against the defender, because the domain belonged to a real organization with real history. URL reputation on the landing page had nothing to score, because the page was two days old. Every static signal either came back clean or came back empty.

Detection has to move to behavior and relationship. The signals that actually matter here are a first-time external sender arriving with a flawless authentication pass, a Spanish-language delivery notice sent to a recipient with no delivery relationship to that sender, a fabricated tracking number that resolves to nothing on any carrier, and a call to action that routes through a tracking redirector before resolving to a domain with no history.

This is where IRONSCALES adds a layer static gateways miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, reads the relationship between the sender, the recipient, and the intent of the message the way a trained analyst would. It weighs the absence of any prior sending relationship against the mismatch between a perfect authentication score and a brand-new redirect target, and flags the credential and data harvesting attempt even when every server-level check reports clean. Across 35,000+ security professionals and 17,000+ organizations, the recurring lesson is the same one the Microsoft Digital Defense Report 2024 draws out: attackers increasingly abuse trusted services rather than break them, and the FBI's 2023 Internet Crime Report ranks this style of identity and infrastructure abuse among the costliest fraud categories.

Mapping to MITRE ATT&CK

The tradecraft maps cleanly onto the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery, a socially engineered notice whose payload is a wrapped link.
• T1583.001 Acquire Infrastructure: Domains covers the freshly registered, privacy-shielded landing domain stood up days before the send.
• T1598.003 Phishing for Information: Spearphishing Link covers the goal, harvesting address and personal data through the confirm-your-address page.

Indicators of Compromise

The Takeaway

Authentication tells you the message really came from where the headers say. It does not tell you the account was not stolen, and it does not tell you the sender means you well. A first-time sender with a perfect score, an urgency deadline, and a button that routes through a redirector to a domain with no past is a profile no single authentication check can catch. Confirm delivery details on the carrier's own site, treat 48 hour deadlines as pressure rather than fact, and pair that habit with detection that reads intent instead of just headers. The next borrowed-reputation phish is already riding someone else's good name.

CISA's guidance on recognizing and stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one