Mexico's Tax Authority, Sent From a Yahoo Account

Every authentication check on this message passed, and every one passed honestly.

SPF passed. DKIM passed. DMARC passed. Microsoft's composite authentication returned a pass with reason 100, the strongest verdict available at the front door. No misalignment, no broken signature, no forwarding hop that muddied the envelope.

There was nothing to catch, because nothing had been spoofed. The message genuinely came from the mailbox it said it came from: a free consumer webmail account on yahoo[.]co[.]jp, Yahoo's Japanese service. The deception sat one layer above anything a protocol inspects. In the display name, and in a notice block inside the body, the sender claimed to be the government of Mexico serving a tax notice.

It arrived in June 2026, in Spanish, addressed to an accountant in the administration function of a medical device manufacturer.

Authentication Validated the Mailbox, Not the Ministry

SPF passed against a sending IP inside Yahoo Japan's outbound relay range, with the envelope mail-from on the provider's own domain. DKIM passed with the signing identity set to that same domain and a provider-managed selector. DMARC passed with an action of none against a header From on the provider domain. Composite authentication agreed and put its confidence at the ceiling. A single relay hop carried the message from the provider into Microsoft's front end, so no intermediate gateway existed to break alignment.

Read literally, those results establish one thing: the message really was sent through Yahoo's Japanese consumer service by someone holding valid credentials for a mailbox there. True, and uninformative, because the question the reader faced was whether a national revenue service had contacted them. No authentication mechanism evaluates that, and RFC 9989 does not ask it to. Alignment compares domains, and both domains here were the attacker's own.

The platform did not even disagree with itself. Microsoft's spam heuristics rated this message at a low spam confidence level while composite authentication returned its maximum pass. Two subsystems, one on provenance and one on content, both benign. Agreement is not corroboration when neither reads the claimed identity.

A Government Ministry With a Random Suffix

The display name read as the Mexican government, followed by a hyphen and a nine-character alphanumeric string. No revenue service appends a random token to its own name.

Inside the body sat a fabricated notice block: two stacked institutional headers naming the Mexican government and a finance ministry, above a bold reference code carrying the tax administration's acronym and a plausible case sequence. A costume assembled entirely out of text, requiring no infrastructure, no lookalike domain and no compromised third party.

Outlook's own external sender banner rendered directly above it, telling the recipient in plain language that they do not often get email from that address. That warning and the authentication passes were both correct at once, pointing in opposite directions.

The Attachment Was Clean Because It Had Nothing to Hide

The message carried a 3.2 KB PDF. Scanners returned clean, and they were right to. It contained no JavaScript, no form fields and no automatic open action.

Its entire content was one sentence of Spanish text telling the reader to click a link to consult the details of the fiscal notification, plus a note that it needs to be opened on a computer.

That is the whole payload. A file with nothing executable in it cannot be detonated, cannot trip a structural rule and cannot fail a malware verdict, and it still carries a URL past all three. This is T1566.001, spearphishing attachment used purely as a transport wrapper, and the mailbox behind it was infrastructure the attacker built rather than stole.

See Your Risk: Calculate how many threats your SEG is missing

The Landing Domain Had Been Waiting Eleven Months

The link pointed at a short, meaningless domain with registrant details redacted for privacy. The instinct at triage is to check the creation date and expect a number measured in hours or days.

It was created in July 2025, roughly eleven months before this message was sent.

That is domain warehousing, and it quietly defeats one of the most widely deployed heuristics in email security. Age rules are calibrated for the burner case: registered same day, registered yesterday, registered this week. A domain left alone for the better part of a year clears all of those thresholds while accumulating none of what makes an established domain trustworthy. No traffic history, no legitimate content, no reputation either way. When the platform scanned the link, the verdict came back partial rather than clean or malicious, which is what a thin history produces.

The registration has not gone quiet since. In the weeks after this incident the WHOIS record was updated and the nameservers changed, which reads as an asset under active management. The useful signal is not age. It is the gap between a long registration and no observed legitimate use.

What Was Left to Detect

Take authentication out of the evidence pool and the remaining case is thin but coherent. A first-time sender for the organization. An institutional identity asserted over a free consumer mailbox. A Spanish-language government tax pretext sent to a manufacturing finance mailbox. An attachment whose only function was to carry a link. A destination with no real history.

That combination is what got it. Themis scored the message at 90% confidence with a credential theft label, drawn from language and structural analysis rather than the header. The incident resolved automatically as phishing and the message was permanently deleted from the single affected mailbox. Reading intent out of structure and language is what Adaptive AI is for once the provenance block has stopped carrying information.

The scale behind the pattern is not exotic. The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access vectors and credentials in 39% of breaches across the kill chain, and the 2025 FBI IC3 Annual Report records 1,008,597 complaints against $20.877 billion in losses. A credential harvesting page behind a dormant domain needs no technical failure in the mail path.

Controls That Would Have Caught This

Score the asserted identity against the class of the sending domain. A tax authority, a bank or a regulator arriving from free consumer webmail is a category error, and cheap to evaluate at delivery. Nothing in SPF, DKIM or DMARC performs that comparison, and a maximum composite result should not raise the trust ceiling on an institutional claim.

Stop treating domain age as a binary. Measure dormancy: a months-old registration with no observed legitimate traffic is the stronger indicator, and the one current tooling misses.

Extract and evaluate attachment text, not just structure. A clean verdict on a file says nothing about the URL written inside it, and OCR on a three kilobyte PDF is trivial.

Treat an unusual sending language for the recipient's role and region as a scoring input, not a curiosity. The CISA phishing guidance argues the same for layered behavioral controls, and the NIST definition of phishing rests on deceiving a person, which no DNS record speaks to.

Indicators of Compromise

MITRE ATT&CK Mapping

The Bottom Line

The cheapest way to survive email authentication is to stop attacking it. Register a mailbox at a consumer provider, let the provider sign your mail correctly, and put the lie where no protocol reads: the display name, a pasted government header, a reference code in bold. Every provenance control then confirms what it was built to confirm, that the mail came from where it says. Whether the sender is a national revenue service was never on the list of questions being asked.