A Real Demio Invite Hid a $969 Crypto Payment Scam

An HR administrator at a large nonprofit hospital system received a webinar confirmation from Demio. It looked routine. The join button worked, the "manage my registration" link worked, the add-to-calendar link worked, and every one of them resolved to a genuine demio.com page. Then, halfway down the same email, sat a line that had nothing to do with any webinar: "your payment of $969.99 USD has been successfully processed via PayPal for your cryptocurrency purchase."

That is the whole attack. Not a spoofed domain. Not a malicious attachment. A real registration confirmation, sent through Demio's own delivery pipes, with a financial-panic hook bolted onto the body and a phone number waiting for whoever called it.

The registration was real, which is exactly the problem

The recipient (or someone using a harvested address) really had been registered for a Demio event. That single fact is what makes this case worth studying. Because the signup was genuine, the confirmation email that Demio generated was genuine too. Every clickable link pointed to demio.com and email.demio.com subdomains and scanned clean, because they were the real thing.

The message was delivered through Mailgun, Demio's transactional email provider, from a legitimate sending IP in Mailgun's pool. There was no attacker-registered lookalike domain to block and no rewritten URL to catch. The platform was not compromised. It was being ridden alongside a legitimate transaction.

This is the uncomfortable modern reality that the 2024 Verizon Data Breach Investigations Report keeps underlining: phishing appears in 15% of breaches, and the human element is a factor in 68% of them. When the technical layer checks out, the attack shifts entirely onto the person reading the email.

The payment claim that did not belong

Nothing about a webinar invite involves a $969.99 PayPal cryptocurrency purchase. That mismatch is the point. The claim exists to short-circuit the reader's judgment: an unexpected charge, a specific dollar figure, and an implied deadline to dispute it. The target was an HR/HRIS department, a team conditioned to handle payment and payroll questions quickly, which makes an out-of-nowhere charge notification more likely to get an immediate reaction than careful scrutiny.

The email then handed the victim a way to "resolve" the charge. The visible support contact was larabently[@]sugtbt[.]com, a domain with no relationship to Demio at all. Right beside it sat a support phone number, +1 803 797 0588. The goal was never a click. It was a callback.

This is textbook vishing, or voice phishing: get the target on the phone, where there is no URL to inspect, no header to check, and no scanner in the loop. On a live call, a trained operator walks the victim toward a "refund" that requires a gift card, a wire, or account credentials. The email is just the trigger. As CISA's phishing guidance notes, attackers increasingly blend delivery channels precisely because a single control rarely covers all of them.

Two identities in one message

The strongest tell here is a contact-channel mismatch, a form of masquerading. The message presented itself as Demio, and legitimately so at the platform level. But its answering channels pointed two different directions at once.

The Reply-To address was lara.bently.cPXRhs[@]mail.demio[.]com, on Demio's real reply subdomain. The support address printed in the body was larabently[@]sugtbt[.]com, on a completely unrelated domain. Same human-looking name, two incompatible destinations. A genuine platform notification does not route its support and its replies to two organizations. That single inconsistency reveals the graft.

Authentication told a similarly split story. At the intermediate Demio/Mailgun hop, the message passed SPF, DKIM, and DMARC cleanly. But the final receiving mail server recorded DKIM and DMARC failures for header.from=demio.com. The IRONSCALES SOC attributed that to intermediate relay and gateway rewriting rather than conclusive spoofing, which is the honest read: authentication results are hop-dependent, and a downstream relay that modifies a signed message will break the signature it never owned. The lesson is not "DMARC failed, therefore spoof." It is that a single green auth check at one hop tells you almost nothing about a message that changed hands three times.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

Mapped to MITRE ATT&CK, this is T1566.002 Spearphishing Link in its purest infrastructure-abuse form (legitimate links carrying an illegitimate message), combined with T1036 Masquerading for the contact-channel mismatch and T1598.003 Spearphishing via Service for the phone follow-through.

Why the gateway waved it through, and Themis did not

A secure email gateway (SEG) evaluates reputation and links. Here, both were clean: a trusted platform, a legitimate sending IP, and destination URLs that genuinely belonged to Demio. There was nothing in the SEG's model to catch. On average, IRONSCALES platform data shows SEGs miss 67.5 phishing emails per 100 mailboxes each month, and messages like this are exactly why.

Themis, our Adaptive AI, does not grade a message on its infrastructure alone. It reads the message the way a suspicious analyst would: a payment and cryptocurrency claim with no relationship to the stated purpose, a support domain that does not match the sender it claims to be, a Reply-To pointing somewhere the body does not, and an inbound phone number acting as the real call to action. Those are content and behavioral signals, not reputation signals, and they are what surfaced this message across the 35,000+ security professionals in 17,000+ organizations that IRONSCALES protects. The Microsoft Digital Defense Report 2024 makes the same case at scale: identity and social-engineering abuse now outpaces malware as the primary path in.

For a healthcare organization, where HR and finance teams field a constant stream of legitimate vendor and platform notifications, this is not an edge case. It is the daily threat surface, which is why healthcare email security has to reason about context, not just infrastructure.

The takeaway: verify the channel, not just the link

When every link in a message checks out, stop trusting the link. The National Institute of Standards and Technology defines phishing by its intent to deceive, not by its delivery method, and this case is a clean example. Teach the people most likely to be targeted (HR, finance, payroll) one durable habit: when an email introduces money, verify the contact channel against the platform it claims to come from, and never resolve a "charge" by calling a number printed in the email that raised it. A phone number in an unexpected payment notice is not a support line. It is bait for a vishing call.