A Perfect DMARC Pass from a Stolen K-12 Mailbox

An administrator at a U.S. K-12 school district emailed a workforce-readiness ed-tech platform provider one afternoon. The subject line was nothing but the district's own name. The body was terse, a short request to review a document, signed off with an office phone extension. There was one link and no attachments. The link pointed at an Adobe Acrobat cloud share.

The administrator did not send it. Someone else was sitting in that mailbox.

That single fact is what makes this case worth a full teardown, because everything a mail gateway measures came back green. Not "mostly green." Not "green with a soft fail buried in a header." Every check, including the ones organizations deploy specifically to stop impersonation, returned a pass on a message that was hostile.

A clean pass on the strictest policy available

The sending district publishes a DMARC record with p=REJECT and sp=REJECT. That is the strongest posture the standard offers, a public instruction to receiving servers to discard any mail claiming that domain unless it aligns under SPF or DKIM, subdomains included. Most organizations never get there. Plenty stall at monitoring mode for years.

It did not matter, and the reason it did not matter is the entire lesson.

SPF passed, with the sending IPv6 address properly designated by the district's own record. DKIM passed with a valid signature, the selector2 key, and a signing identity aligned to the same domain in the header From. DMARC therefore passed on alignment, and the published reject policy was never invoked because there was nothing misaligned to reject. Two separate Authenticated Received Chain seals, i=1 and i=2, both verified, confirming the message was not modified as it moved between hops.

The routing was equally unremarkable. An internal Microsoft 365 tenant hop marked as internal cross-tenant traffic, out through Microsoft's shared outbound protection infrastructure, into the recipient's Google mail exchanger. That is the ordinary path for tens of millions of legitimate business messages a day. There was no odd relay, no non-standard port, no gateway rewriting content mid-flight.

Nothing here was spoofed

It is tempting to file this under impersonation. It is not impersonation. No brand was faked, no lookalike domain was registered, and the district's name in the subject was not a costume, it was the truth.

The compromise happened one layer above the DNS. An attacker obtained working credentials to a real staff mailbox and sent from inside it. Authentication was not defeated, bypassed, or tricked. Authentication was asked a narrow question, did this message originate from the domain it claims, and it answered correctly. The answer was yes.

The 2024 Verizon Data Breach Investigations Report puts stolen credentials at the top of the initial-action list, present in 38 percent of breaches, with the human element factoring into 68 percent overall. That statistic has a direct operational consequence visible right here. When credentials change hands, the attacker inherits the mailbox's authentication posture, its domain reputation, its sending history, and its established relationships, all of it, for free. MITRE ATT&CK tracks the pattern as compromising email accounts, and it is the cleanest way to convert a strong security investment like a reject policy into an asset that works for the attacker.

One link, one clean verdict, one open question

The payload was a single Adobe Acrobat cloud-share URL on hxxps://acrobat.adobe[.]com, the real Adobe service, not a lookalike. Automated analysis fetched the page, captured a screenshot, and returned a verdict of clean.

Precision matters here, so here is exactly what the record supports and what it does not. No credential-harvest form was independently confirmed on that share. What is documented is a terse unexplained document-review request, from a first-time sender, pointing a single recipient at a hosted document on a platform where the actual content can be swapped or gated after the initial scan. Legitimate cloud document hosts are abused for credential collection constantly, precisely because they carry no reputational penalty and no blockable attacker domain. The risk is a pattern inference, not a verified finding, and treating it as anything firmer would be dishonest.

That is also what makes this shape of attack, catalogued as spearphishing via link, so awkward for signature-driven and reputation-driven controls. There is no attachment to detonate, no fresh domain to blocklist, no authentication anomaly to alert on. As NIST's definition of phishing makes plain, the mechanism is deception of a person, and none of the technical layers in this message contained any deception at all.

See Your Risk: Calculate how many threats your SEG is missing

The two signals that were left standing

Strip out everything that passed and two things remain.

The first is relationship. This sender had never corresponded with the recipient organization before. A first-time sender is not suspicious on its own, thousands arrive legitimately every day, but a first-time sender delivering an unexplained document link to exactly one mailbox is a different shape. The second is sender risk. The sender profile carried a high risk level, assembled from behavior rather than cryptography, sitting in direct contradiction to a flawless authentication result.

Our Adaptive AI, Themis, weighed those against the message content and returned a 59 percent confidence with a credential-theft label, flagging subtle wording and message-pattern characteristics common to more careful phishing attempts. Worth noting for calibration, that is a moderate score, not a slam dunk, and no community reporting or sender-analysis corroboration existed for this message. Automated threat detection surfaced it and opened an incident on one affected mailbox, which at the time of the record was still open rather than closed out.

That is what honest detection on a fully authenticated compromise looks like. Not a confident verdict from a single decisive signal, but a behavioral contradiction strong enough to pull a message out of the flow for a human to look at.

The vendor is the real target

Districts trade routine document-share email with software vendors, payment processors, transportation contractors, and staffing partners all year. That traffic is expected, it is authenticated, and it is trusted on both ends. A hijacked district mailbox is therefore not really an attack on the district. It is a pass into every organization the district does business with, which is why education-sector email security has to be evaluated on outbound abuse and vendor exposure, not just inbound filtering.

For the receiving side, the control that matters is grading the sender's behavior independent of the envelope, which is the core premise of account takeover protection. CISA's phishing guidance makes the same point from the process angle. Break the cycle at the behavior, because the credentials are already gone.

Indicators of Compromise

MITRE ATT&CK mapping

See you next time

A reject policy is worth publishing. So is a valid DKIM key, and so is an intact ARC chain. None of them were designed to tell you whether the person at the keyboard is the person who owns the mailbox. When the credentials are real, the only question left is whether the behavior fits, and that question has to be asked by something other than the envelope.