The Share Button Looked Real. The Domain Didn't.

The Open button inside that Google Sheets share invite pointed to a path that read RNACORPORAT. Close enough to a real company name to survive a quick glance. The problem was the domain sitting in front of it: kalmexo[.]vu, a Vanuatu address with no WHOIS transparency and no relationship to Google, to Sheets, or to any document the recipient had ever been invited to open.

The message arrived at a specialty flavors and ingredients manufacturer and hit four mailboxes before it was quarantined. It carried no attachment. The entire attack lived in a single spoofed button and the redirect chain hiding behind it.

A Google Sheets Invite That Never Touched Google

The email reproduced the Google Sheets sharing UI (user interface) almost pixel for pixel: the branded header, the familiar "has invited you to VIEW the following spreadsheet" block, and a green Open button. Around it, the attacker wrapped a real corporate signature, a physical mailing address, and a scatter of genuine links to legitimate destinations. That mix is deliberate. A message that is 90 percent authentic and 10 percent malicious reads as trustworthy to both humans and to rule-based filters counting "known good" links.

What made this one land was the sending identity. The message came from Procurement@rnacorporation[.]com, a Microsoft 365 (M365) tenant belonging to an unrelated third-party company. That tenant was abused to send, which meant the mail carried the sender's real authentication instead of anything an attacker had to forge.

Why the Authentication Signals Did Not Save Anyone

Run the headers and the case looks clean at first: SPF (Sender Policy Framework) passed, DKIM (DomainKeys Identified Mail) passed against RNACorporation.onmicrosoft.com, and ARC (Authenticated Received Chain) passed. But the DMARC (Domain-based Message Authentication, Reporting and Conformance) result was only bestguesspass, not a strict aligned pass. That distinction matters. Bestguesspass is an inference the receiver makes when strict alignment cannot be confirmed, not a guarantee that the domain owner authorized the message flow. A DMARC result that reads "pass" in a log is not the same as a DMARC result that proves alignment, and attackers riding a legitimate tenant know the difference.

This is the uncomfortable truth SEGs (secure email gateways) keep running into. Authentication tells you a message was sent through infrastructure that was allowed to send it. It tells you nothing about whether the content is hostile.

See Your Risk: Calculate how many threats your SEG is missing

One Truncated Path, Two Attacker Domains

The Open button href resolved to hxxps://kalmexo[.]vu/RNACORPORAT. The truncated path is the trick. "RNACORPORAT" visually echoes the sending company name, so a recipient who hovers sees a string that feels associated with the sender and lowers their guard. The domain itself has nothing to do with that company.

From there the link 302-redirected through Cloudflare to a gating and landing page on positivevisitorexperience[.]de. The Cloudflare hop launders reputation and defeats simple domain blocklists, because the first thing a scanner sees is Cloudflare infrastructure rather than the final German-registered payload host. Link analysis scored the redirect chain HIGH risk at roughly 0.78. This is textbook MITRE ATT&CK T1566.002, spearphishing via link, layered on top of a compromised trusted account.

The end state was almost certainly credential harvesting. No malware, no macro, no attachment to detonate. Just a believable pretext and a page built to collect whatever the victim typed.

What This Costs When It Works

Phishing was present in 15 percent of breaches in the 2024 Verizon Data Breach Investigations Report, and the median time from opening a phishing email to clicking was 21 seconds, with another 7 seconds to submit data. Twenty-eight seconds, start to finish. The Microsoft Digital Defense Report 2024 documents the same pattern at scale: adversaries increasingly abuse legitimate services and compromised tenants to slip past reputation-based controls. The FBI IC3 2023 Internet Crime Report attributed billions in losses to business email compromise and related account abuse, the category this attack feeds directly into.

CISA phishing guidance is blunt about the fix: technical controls have to assume a convincing message will reach the inbox, then catch it on behavior rather than reputation alone.

Catching What the Headers Missed

This is where reputation-first defenses fail and behavior-first defenses win. Themis, the agentic AI SOC (security operations center) analyst built by IRONSCALES, does not stop at "SPF pass, DKIM pass, DMARC pass" and wave the message through. Its Adaptive AI reads the message the way an analyst would: a Google Sheets share notification that did not originate from Google, a button path truncated to mimic the sender, a redirect chain terminating on an unrelated foreign domain, and a first-contact procurement pretext from a tenant this organization had never transacted with. Any one of those is a weak signal. Stacked together, they are a conviction.

Themis quarantined the message across all four affected mailboxes, and because IRONSCALES learns from every organization in its network of 35,000+ security professionals across 17,000+ organizations, a variant landing in a different tenant tomorrow inherits today's verdict.

The Takeaway

Stop treating an authentication pass as a verdict. It is one input. This attack passed SPF, passed DKIM, and earned a soft DMARC pass, and it was still hostile. Train your controls, and your people, to ask a different question: does the story this message tells hold up? A spreadsheet you never requested, shared by a company you have never worked with, behind a button whose real destination is a Vanuatu domain, does not. The share button looked real. Everything behind it was the attack.

Indicators of Compromise