The Bank Authorization Lure Amazon SES Waved Through

An email arrived at an asset-management firm and cleared every authentication check a mail system can apply. SPF passed. DKIM passed. DMARC returned a pass verdict. The message came off Amazon SES, some of the most reputable bulk-sending infrastructure on the internet, and the receiving edge logged compauth=pass. On the strength of those signals, most gateways would treat it as trustworthy and move on.

The link inside it read the recipient's own email address before that person ever decided to click.

Two colleagues in the same mailbox domain got the message, which carried an urgent financial-authorization theme: a fabricated tranche and reference number, a bank authorization, a disbursement described as already processed. It was engineered to make a finance-adjacent reader act before thinking. What made it worth a full teardown was not the pretext, which is ordinary, but the delivery chain, which quietly weaponized a legitimate service, a compromised third-party website, and the victim's own address against them.

Authenticated, and Still Hostile

The authentication story is the part that should stick with any defender. The message was sent from an Amazon WorkMail sending address on SES, so SPF passed on the sending IP (54.240.48.33, in Amazon's published range) and DKIM passed on the signing domains 2a2[.]awsapps[.]com and amazonses[.]com. DMARC recorded a best-guess pass, and composite authentication came back clean.

Every one of those checks did its job correctly. That is the uncomfortable point. Authentication proves that a server was authorized to send and that the body was not altered in transit. It says nothing about whether the content is honest. When an attacker sends through shared, trusted infrastructure, they inherit that infrastructure's clean reputation for free. The visible From header was itself URL-encoded to blur the true sending identity, so a human skimming the header saw noise rather than the WorkMail address underneath.

This is the same shift documented in the Microsoft Digital Defense Report 2024: attackers increasingly abuse legitimate cloud services rather than trying to break them, because a trusted sender clears filters that a suspicious one never would.

See Your Risk: Calculate how many threats your SEG is missing

The Redirect That Knew Your Name

The Review Document call to action did not point at a landing page. It pointed at an ad-manager tracking script hosted on kimutatas[.]hu, a compromised Hungarian WordPress site whose plugin the attacker abused as a redirect service. The site owner is a victim here too. Their infrastructure was hijacked to launder the click and to add reconnaissance the attacker could not perform from inside an inbox.

Embedded in the link was a base64-encoded copy of the recipient's own email address, sitting in the URL fragment. When the tracking script ran, it decoded that value, confirming a real person had opened a real message at a live mailbox, then forwarded the browser to a dashboard-style page on momentumacademy[.]co[.]in, an Indian domain that IRONSCALES flagged as malicious. The base64 wrapper is trivial obfuscation, but it does two jobs at once: it hides the target address from a casual glance at the link, and it turns every click into a validated-mailbox signal for follow-on targeting.

Layering matters here. A URL scanner that inspects only the visible destination sees a Hungarian WordPress site, not the Indian dashboard behind it, and a reputation engine may have nothing bad on record for a legitimate site that was compromised yesterday. The malicious verdict lived one hop past where most static checks stop looking.

Three Signatures, One Fake

The body reached for social proof by stitching together signature blocks from three unrelated legitimate companies: a warehousing operator, a capital-markets firm, and an insurance brokerage. None of them had any connection to each other or to the recipient. Piling on real corporate footers is a cheap way to manufacture the texture of a forwarded, vetted financial thread. To a reader scanning for the usual markers of a real business email, three formal signatures read as more credible than one, even though the combination makes no logical sense.

Mapping to MITRE ATT&CK

The tradecraft maps cleanly onto the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery: a socially engineered message whose payload is a link routed through a redirector.
• T1204.001 User Execution: Malicious Link covers the reliance on the recipient clicking Review Document to reach the hostile page.
• T1036.005 Masquerading covers the obfuscated From header and the borrowed corporate signature blocks.
• T1027 Obfuscated Files or Information and T1071.001 Web Protocols cover the base64-wrapped recipient address and the WordPress redirect used as command infrastructure.

Indicators of Compromise

Detection: Read Intent, Not Headers

Static defenses were always going to struggle with this one. The sending infrastructure was legitimate, the authentication was genuinely clean, and the first redirect landed on a real (if compromised) website. Signature and reputation checks had almost nothing to grab. Detection has to move to behavior and relationships: a From identity that does not match the mailbox that actually sent the message, a call to action that redirects through an unrelated third-party site before resolving, a link carrying an encoded copy of the recipient's own address, and a body pretending to be a vetted financial thread by borrowing footers from companies that have no business being on the same email.

This is where the IRONSCALES platform adds a layer that gateways miss. Themis, our Adaptive AI analyst, weighs the relationship between the claimed sender, the real sending address, and the full redirect chain the way a trained analyst would, flagging hostile intent even when SPF, DKIM, and DMARC all pass. That behavioral read is what catches credential-harvesting and business email compromise that ride trusted infrastructure. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and names pretexting, largely business email compromise, as the top social-engineering incident type, with a median transaction around 50,000 dollars. The FBI's 2023 Internet Crime Report likewise ranks business-identity and financial-authorization fraud among the costliest categories reported. The lesson across 35,000+ security professionals across 17,000+ organizations that IRONSCALES works with is consistent: an authentication pass is a starting point, not a verdict.

The Takeaway

A clean SPF, DKIM, and DMARC result tells you a server was allowed to send and the message was not tampered with in flight. It does not tell you the sender is honest, and attackers who send through Amazon SES, Microsoft, or any other trusted service know exactly how much that clean verdict buys them. The defense is to treat authentication as one input among many, to trace links all the way to their final destination rather than their first hop, and to be suspicious of any financial-authorization message whose reply and redirect paths wander off the sender's own turf. CISA's guidance on recognizing and stopping phishing early is a solid team reference for building that reflex: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one