A Company Impersonating Itself, From Someone Else's Mailbox

A message titled New SOPs Assigned arrived in the mailbox of a vice president at a regional construction firm. The subject line named his own employer. So did the sender display name. Both carried the same eight character reference code appended to the company name, the way an automated document system might tag a workflow item.

SPF passed. DKIM passed under the sending domain. DMARC passed. Microsoft's composite authentication returned a pass with reason code 100, the value reserved for a message that satisfied every identity check the service knows how to apply.

None of it was forged, and none of it belonged to the construction firm. The message came from a mailbox on an unrelated freight and logistics company's domain, registered more than two decades earlier, through that company's own production mail server. The authentication was genuine because the sending infrastructure was genuine. Only the identity presented to the reader was invented.

Two Halves of One Sender Field, Telling Different Stories

The From header contained a contradiction that no authentication standard is designed to notice. Its address half resolved to a real mailbox at the logistics domain. Its name half read as the construction firm, the company name followed by an underscore and the eight character reference.

DMARC evaluates alignment between the domain in that address and the domain that signed the message. It answered correctly here, because the two agreed. What it does not evaluate, and was never built to evaluate, is whether the human readable name beside the address bears any relationship to the organization it invokes. That field is free text. Most mail clients render it prominently and collapse the address behind it, so the part the standard verifies is the part the reader is least likely to see.

Microsoft's own tenant did surface one hint, a first contact safety tip noting that the recipient did not often receive mail from this sender. That is a relationship signal rather than an authentication one, and it appeared alongside a header block in which nothing had failed.

The header chain shows the message leaving the logistics company's own Kerio Connect mail server and traversing a cloud hosted relay before reaching the recipient's Microsoft 365 tenant. That is the path of a real mailbox sending real mail, not of a spoofing attempt.

A Document Card for a File That Did Not Exist

The body was a rendered HTML card built to look like an enterprise document assignment. A line announced that a document had been assigned from the firm's own team workspace and required review. A tile styled as a PDF carried a title matching the firm's operating procedures. Beside it sat an assignment timestamp precise to the second, an Action Required badge, and a single Review Document button.

Two details are worth separating from the design work. The greeting was assembled from the recipient's mailbox name rather than a real first name, the signature of personalization derived from an address list rather than a directory. And the timestamp was fabricated. Precision to the second reads as system generated authority, which is why kits print it; there was no document, so there was no moment at which anything was assigned.

The eight character reference appeared three times, in the subject, in the sender name and inside the card. One identifier stitched through every rendered field is how a template behaves, not how a document platform labels a sender.

The Landing Page Was Rented by the Millisecond

The Review Document button pointed at a bare public function URL on a major cloud provider's serverless compute service, in its us-east-1 region. A random thirty two character function identifier, the provider's own domain, no path, no logo, no company name anywhere.

Serverless function URLs are ordinary infrastructure and abuse of them is well established, so the hosting choice is not the story. The mismatch is. A corporate document review flow that genuinely belonged to either company would live on a domain belonging to one of them, or on a recognizable document platform. What the button actually offered was a brandless compute endpoint with no relationship to the construction firm, the logistics firm or any document product.

For an attacker the economics are hard to beat. No domain to register, no certificate to purchase, no reputation to age, because the address inherits an apex domain owned by the cloud provider and trusted everywhere. Newly registered domain heuristics have nothing to grade, allow lists built around major cloud services work in the attacker's favor, and the endpoint vanishes the moment the function is deleted.

See Your Risk: Calculate how many threats your SEG is missing

What Flagged It, and How Confidently

Adaptive AI scored the message at 57 percent confidence, labeling it credential theft aimed at a senior recipient. That number deserves to be reported as what it is: moderate, not decisive. The signals available were behavioral rather than technical, since the technical layer had returned nothing but passes. A sender with no correspondence history. A display name asserting an organization the sending domain had no connection to. A greeting generated from an address. A destination unrelated to every party named in the message.

A human analyst reviewed the case, confirmed it as phishing and quarantined it. Machine surfacing plus analyst confirmation is the honest description of what happened here. The NIST definition of phishing turns on deception and objective, both of which this message supplied while satisfying every control designed to establish who sent it.

What This Should Change

The 2024 Verizon Data Breach Investigations Report puts the human element in 68% of breaches, phishing in 15%, and stolen credentials in 38% as the top initial action. It also measures the median time to click a phishing link at 21 seconds, and 28 seconds to submit data on the page that follows. The 2023 FBI IC3 report records roughly $2.9 billion in reported business email compromise losses. Fully authenticated mail keeps those numbers durable, because it satisfies the identity layer instead of evading it.

Two practices follow directly. First, compare the display name against the sending domain as a scored check rather than a reader's responsibility. A name asserting one organization from a domain belonging to another is a machine readable contradiction, and it is the entire attack here. Business email compromise defenses that only inspect authentication results will pass this message every time.

Second, treat brandless hosting as an attribute worth scoring, not a neutral one. A document review claim that resolves to a compute endpoint with no organizational identity is contradicted by its own destination, which is the separation between sender validation and payload handling that CISA's phishing guidance recommends. Credential harvesting defenses need to weigh where a link lands, and how much that place resembles what it claims to be, alongside whatever the headers say.

Indicators of Compromise

MITRE ATT&CK Mapping