The Phish That Came From a State AG's Own Inbox

The phishing email that landed in a municipal police department's real-time crime center passed every authentication check, cleanly, without a single failed signature. SPF passed. DKIM passed. DMARC passed. The compound authentication result came back at the top score. Nothing in the transport layer looked wrong, because nothing in the transport layer was wrong.

The message genuinely came from a U.S. state Attorney General's Office.

That is the whole problem. The sender was not spoofed, not forged, and not riding a lookalike domain. It was a real, fully credentialed government mailbox, sending an urgent secure-message notification to a senior officer at another agency. The authentication that most controls treat as proof of trust was, in this case, proof of nothing except that an attacker was inside a legitimate account.

An Authenticated Sender Is Not a Trustworthy One

Walk the auth results and you will not find a flaw. SPF passed on the sending IP, which resolves to the state government's own mail infrastructure. DKIM passed on a signature aligned to the Attorney General's Office domain, using a real selector the office had published. DMARC passed with alignment intact. The Microsoft 365 edge logged the compound authentication result as a full pass.

Email authentication answers one narrow question: did this message actually originate from the domain it claims? Here the honest answer was yes. What SPF, DKIM, and DMARC cannot answer is whether the human, or the process, behind that mailbox is acting in good faith. When an attacker controls the account itself, every one of those checks turns from a defense into a credential the attacker gets to borrow. This is account takeover turned into a delivery vehicle, and it is precisely why a passing DMARC result should never be mistaken for a verdict on intent.

The behavioral tells were there for anyone reading the message rather than the headers. A government office does not typically route official notices to outside law enforcement as a generic secure-message alert. The body carried a fabricated expiration deadline meant to rush a click, along with address and phone-number inconsistencies and awkward phrasing that a genuine agency notification would not contain. And the same lure hit the target mailbox four times across two days before an analyst manually reviewed it and confirmed it as phishing. Repetition like that is the signature of an abused account running an outbound campaign, not a one-off official message.

Where the "Open Message" Link Actually Went

The entire payload was a single call to action: an Open Message button, framed as the way to retrieve a waiting secure document before it expired.

That button did not point at any recognized government secure-portal service. It chained through uxfol[.]io, a consumer redirect hop, before resolving to bigurl[.]io, a shortener domain registered in December 2023 through Cloudflare with no meaningful WHOIS attribution, roughly a year before this message arrived. A legitimate secure-message system from a state agency does not hand its recipients off through a stack of anonymous consumer redirectors to a barely-attributed shortener. The redirect chain is what stripped the government context the branding had promised and hid the true destination from a casual hover.

The final landing page was not captured for independent analysis, so the exact payload behind the shortener is unconfirmed. The structure, though, is a textbook credential-harvest funnel: an authenticated sender to clear filters, a manufactured deadline to compress judgment, and a layered redirect chain to conceal the endpoint. The goal of that endpoint is almost always the same, which is why credential-harvesting protection that inspects behavior rather than just link reputation is the layer that matters here.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft maps to a short, coherent chain in the MITRE ATT&CK framework:

• T1586.002 Compromise Accounts: Email Accounts covers the core of the operation. The attacker did not build infrastructure, they took over an existing, reputable government mailbox and sent from it.
• T1566.002 Spearphishing Link covers the delivery: a socially engineered notice whose payload is a single link.
• T1204.001 User Execution: Malicious Link covers the intended finish, the recipient clicking Open Message and following the redirect chain.

Indicators of Compromise

The sending mailbox and its originating IP are deliberately absent from this table. They belong to a legitimate government office whose account was abused, which makes that office a victim here, not an indicator to block.

Detection and What to Watch For

Reputation and signature checks were always going to wave this through. The sender had genuine authentication, an established government domain, and no attachment or malware to scan. Detection has to move to behavior and relationship. The signals that mattered were a known-category sender suddenly issuing an out-of-character secure-message alert, a manufactured expiration deadline, a call to action that redirected through consumer services to a young shortener instead of expected infrastructure, and the same lure repeating into the mailbox within a two-day window.

This is where IRONSCALES adds a layer static gateways miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, models the normal relationship and behavior of a sender the way a trained analyst would, so an authenticated but anomalous message from a compromised account is flagged even when every server-level check comes back clean. Across 35,000+ security professionals and 17,000+ organizations, the recurring lesson is that authentication is a starting point, not a conclusion.

The data backs the shift. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and stolen credentials among the top initial actions, present in 38 percent. The Microsoft Digital Defense Report 2024 documents the same move toward abusing trusted accounts and services rather than breaking authentication, and the FBI's 2023 Internet Crime Report ranks business and government identity impersonation among the costliest categories of loss. Guidance from CISA on recognizing and stopping phishing early is a solid team reference for building that reflex: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one

The Takeaway

A green authentication result tells you a message came from where it claims. It tells you nothing about whether the account behind it has been taken over. When the sender is a real government office and the link is a shortener registered by nobody in particular, the headers are not the story. Treat authentication as one input, weigh the behavior and the destination against what that sender normally does, and remember that the most convincing phish of the year may arrive perfectly signed. The next one already has valid DKIM.