A Hijacked University Mailbox Plays Process Server

A single mailbox at a claims-management firm handling French-language cases received a message that read exactly like a court document. The subject and body were in formal, all-capitals French: an accusation, a case reference, and a countdown. Respond within 72 hours, the email warned, or the matter would proceed without the recipient. Attached was a file named CONVOCATION.pdf, French for a summons. Everything about it was engineered to trigger the one reaction that shuts down careful thinking, the fear of a legal deadline. And almost none of the usual tells were present. The message came from a real Microsoft 365 mailbox, and it passed through two legitimate secure email gateways before it landed.

A summons that never came from a court

The lure worked on pressure, not on payload. The body carried no obvious request for credentials or payment. Instead it leaned entirely on the shape of a legal threat: capitalized text to convey formality and alarm, a fabricated matter reference, and a hard 72-hour window that framed any hesitation as a mistake with consequences. The attached PDF was named for a summons and had been scanned clean by antivirus. Its inner contents could not be independently confirmed, so the safest reading is that the attachment existed mostly to complete the illusion of an official document rather than to carry a confirmed exploit. When a message tells a busy professional that a court deadline is running against them, the attachment does not need to do much. The countdown does the work.

The message was also addressed to a French-language legal-intake alias on a privately registered domain rather than to an official government mailbox. France's actual justice ministry publishes mail on justice.gouv[.]fr. An unsolicited legal accusation routed to a look-alike intake address, not an official channel, is exactly the kind of context mismatch that should raise a flag, even when the individual technical checks look ordinary.

Clean at the source, broken at the door

The authentication story is where this case gets instructive. At the earliest hop, a direct submission from the sending mailbox's Microsoft 365 tenant, SPF, DKIM, and DMARC all passed for the sending domain. There was nothing forged about the origin. The account genuinely belonged to a Mexican university, and the mail genuinely came from that tenant.

By the time the message reached its destination, the picture looked very different. After transiting Mimecast and then Microsoft Exchange Online Protection, the final Authentication-Results showed SPF permerror (an overlong, malformed include chain), DKIM failure (a body-hash mismatch), and DMARC failure. On the surface, that is a triple failure that many people would read as a spoof. But the ARC chain validated, cv=pass, which tells the real story. Two legitimate gateways had processed and modified the message in flight, most likely injecting a disclaimer and re-handling the body, and that processing invalidated the original DKIM body hash and broke SPF alignment downstream. This is expected gateway behavior, not evidence of forgery.

Why a failed authentication check meant nothing here

A filter that treats a final-hop SPF, DKIM, or DMARC failure as proof of spoofing would misjudge a message like this in both directions. It would wave through plenty of genuine forgeries whose origin looked clean, and it would flag enormous volumes of legitimate business mail that gateways legitimately rewrite every day. DMARC alignment, defined in RFC 7489, assumes the message reaching the evaluator is the message the sender signed. Once a gateway injects content, that assumption no longer holds, and the failed verdict becomes noise.

That is the deeper trap of a compromised-account attack. The origin authentication was clean precisely because the account was real. Someone had taken over a trusted mailbox and used it as a launch pad, a pattern MITRE tracks as Compromise Accounts: Email Accounts. Because the sender was authentic, every reputation and alignment check that a gateway leans on at the origin cooperated. This is why treating a legitimate mailbox as automatically safe is dangerous, and why account-takeover protection that watches for a trusted sender behaving abnormally matters as much as inbound filtering. The two secure email gateways in the delivery path did not stop this message. They forwarded it and, along the way, mangled the very signals a downstream tool might have relied on. If your own stack quietly depends on gateways to catch what they demonstrably let through, an email security gap assessment is worth the hour.

Reading the signal the gateways missed

With authentication effectively useless as a discriminator, the useful signal lived in the content and the context. Our Adaptive AI analyst, Themis, flagged the message at moderate confidence on a phishing-content pattern rather than on any auth verdict. The elements that drove the call were behavioral: the fear and urgency narrative, the all-capitals legal framing, the fixed 72-hour deadline, a first contact from a sender with no prior relationship to the recipient, and a subject and attachment theme that made no sense against an origin that authenticated as a Mexican university's Microsoft 365 tenant.

Those are the signals that hold up when technical checks do not. The 2024 Verizon Data Breach Investigations Report found the human element present in 68 percent of breaches and phishing involved in 15 percent, and it measured the median time to click a phishing link at just 21 seconds. A summons lure with a countdown is built to win inside those 21 seconds, before anyone stops to verify the source. Detection that reads the manipulation, not just the envelope, is what closes that window.

What defenders should take from this

• Do not treat a final-hop SPF, DKIM, or DMARC failure as a reliable spam or spoof signal. Legitimate gateways break downstream authentication constantly. Check the ARC chain and the origin before drawing conclusions.
• Give compromised-but-legitimate-account sends first-class weight. A clean origin auth is not proof of a clean intent when the account itself is under attacker control.
• Make urgency plus legal or financial fear a review trigger, especially from a first-time sender. As CISA phishing guidance notes, manufactured pressure is the common thread across phishing lures.
• Weight relationship history and content behavior over authentication alone. That is where a summons scam like this one actually exposes itself.

Indicators of compromise

MITRE ATT&CK mapping