The W-9 Was Real. That Was the Point.

Two PDFs were attached to the message that landed in the accounts-payable shared mailbox of a global pharmaceutical contract development and manufacturing organisation, at its specialty-chemistry subsidiary, one morning in late August 2026. The first was an invoice for 31,471.35 US dollars in LinkedIn Corporation's name. The second was a completed IRS Form W-9, also in LinkedIn Corporation's name. Automated file scanning cleared the invoice and flagged the tax form.

It had the two documents exactly backwards, and the reason is the whole case. The invoice was a fabrication built for this attack. The W-9 was not a forgery at all. It was a real, correctly executed tax form belonging to the real company, and that is why it worked.

The Tax Form Was Real

We rendered and byte-scanned the file rather than trusting a verdict on it. It is a completed Form W-9 (Rev. March 2024): entity name on line 1, the C-corporation box checked, an exempt payee code, a FATCA code, the brand's genuine corporate address in California, a filled federal tax identification number, a handwritten-style signature dated in early January 2025, and an e-signature envelope identifier printed across the header, all consistent with a genuinely executed document. Every field that can be independently checked is correct. The tax number and the principal address both match the brand's publicly documented details.

The document's own metadata puts it roughly nineteen months ahead of the attack. Its producer string is a Windows print-to-PDF driver and its creation timestamp is the day after the signature date. This was a document printed once, in January 2025, by someone in a finance function, and then kept. It was not generated for this campaign.

It also does nothing. A key-level scan of the bytes found no auto-action dictionary, no document-open action, no JavaScript, no launch action, no embedded file and no form logic. Its single image stream is a raster of the signature band. There is no payload in it, because the payload was never meant to be in it. The only visible tell is a lowercase letter in the brand name in the filename.

What a W-9 Actually Proves

Vendor onboarding asks for a W-9 for good reasons, and accounts-payable teams have learned to treat a signed one with a matching tax number as identity proof. It is not. It is proof that the document is real and that the details printed on it belong to the named company. Nothing on a tax form says anything about the person who emailed it to you.

That gap is trivially exploitable when the impersonated payee is a household name. A widely invoiced global brand has issued its W-9 to a very large number of customers, so a genuine copy is effectively a commodity in circulation. The record does not establish how this operator got hold of theirs, and it hardly matters: the control that exists to verify a payee validated the attacker instead, and did so honestly, because the artifact it was handed was genuine. The logic that makes the form useful against an obscure new vendor makes it worthless against a famous one.

The Half That Was Fabricated

The invoice was the attacker's own work, printed to PDF from a web page in the same minute the message was sent. It bills four real product lines from the brand's catalogue, with line items that sum exactly to the balance due, and it carries the same genuine tax number and corporate address lifted off the tax form. The billing block was personalised to the subsidiary and addressed to its chief executive. Invoice date and due date are identical, with terms of on receipt, so it was already twelve days past due when it landed. The footer even asks the reader not to remit to the only genuine address on the page.

The message around it reproduced a small set of mechanics we have documented before: an internal forward apparently from the subsidiary's chief executive routing the invoice to accounts payable, a quoted vendor thread beneath it attributed to an invented accounts-receivable persona on a LinkedIn lookalike domain registered three days before the send, a reply address on a second throwaway domain registered the day before, and delivery through a small US technology company's authenticated transactional sending path, which produced a clean aligned pass on DMARC at the recipient's gateway.

See Your Risk: Calculate how many threats your SEG is missing

What is worth dwelling on is what those attachments did not contain. Neither PDF holds an account or routing number. The invoice's payment section refers the reader to a payment-instructions attachment that does not exist, and the body's own line offering ACH information is followed by nothing at all. The message instead asks three separate times for a confirmation or a reply, so the transaction cannot proceed without one. The paperwork was the credential; the conversation was the objective.

Quarantined, Then Released

Microsoft 365 classified the message as user impersonation, injected its own warning banner into the rendered body, and quarantined it. Roughly eighteen hours later it was released into the accounts-payable shared mailbox with that banner still attached. The record shows it was released, not who released it. From there it was reported into IRONSCALES, where Themis returned a recommendation confidence of 84 and rated the sending identity high risk, and a human analyst closed it as confirmed malicious. One mailbox was affected, and there is no evidence anyone replied or that any funds moved.

The two file-level verdicts are the honest lesson. Attachment scanning answers whether a file will do something to the endpoint, and both of its answers were defensible in isolation and useless in context, because the document that mattered was the one that was real and inert. A genuine artifact attached to a false claim is not a malware problem. It is a verification problem, and it belongs to the business email compromise control set rather than the scanner.

The 2026 Verizon Data Breach Investigations Report puts the human element in 62 percent of breaches and pretexting, newly tracked this edition, at 6 percent of initial access vectors, and frames generative AI's contribution as operational scale rather than novel technique. Nothing here is new, and the only expensive component was a document the operator did not have to make. The 2025 FBI IC3 Annual Report records 3,046,598,558 US dollars in reported business email compromise losses, a category whose entire attack surface is a request that looks correct.

The countermeasure is not a scanner setting. Collecting a payee's paperwork is not verifying a payee. The verifying step is an out-of-band callback to a number the organisation already holds for the vendor of record, made before any first payment or change of remittance detail, and immune to contact details supplied inside the requesting message. Documentation that is complete and checkable should raise that bar, not lower it.

Indicators of Compromise

Excluded deliberately: the sending domain and mailbox belong to a real operating business whose authenticated path was abused; the egress address is shared platform infrastructure; and the message's only web link resolved to the brand's genuine site and scanned clean.

MITRE ATT&CK Mapping

Sources: 2026 Verizon Data Breach Investigations Report; 2025 FBI IC3 Annual Report; CISA phishing guidance; NIST glossary: phishing; RFC 9989 (DMARCbis).