The Email From Yourself That Your Own Domain Disowned

A client-facing financial advisor at a financial advisory firm opened a document-signature notice that appeared to have come from their own mailbox. The address in the From field and the address in the To field were the same string, character for character: the advisor's own work email. Nothing else in the headers agreed with that story. SPF failed explicitly. There was no DKIM signature at all. DMARC failed. The message had entered from a commodity bulk-hosting IP with no relationship to the firm's mail path. Every protocol check that defenders treat as authoritative disowned this message, and it reached the inbox anyway.

The subject read Uncompleted: Document Arrived For Signature. Ref:OQTTHI9Uu. The sender alias was "Signly Via", a generic-sounding e-signature brand rather than any named colleague or executive. The body offered one action, a button labeled "Start signing". A single mailbox was hit, the advisor did not click, and the platform resolved the message as phishing the same day it landed in the third week of August 2026.

Authentication Failed on Every Line and the Message Still Landed

This message was not marginal. It was rejected by every mechanism the domain owner has available, and then delivered.

Two of those rows are worth sitting with. The first is the DMARC line. A recorded failure with no enforcement action is a failure that generates a report and changes nothing about delivery. That is the practical difference between publishing a DMARC record and enforcing one, and it is the gap RFC 9989, the current DMARC specification, exists to help close. A domain that fails a message and then asks nothing of the receiver has described the problem without instructing anyone to act on it.

The second is the composite authentication line. Microsoft's composite check returned a pass carrying reason code 702 while SPF, DKIM, and DMARC had all just failed. The record does not document what that reason code means internally, so the honest description is the one the headers support: the individual protocol checks failed, the composite verdict passed, and the composite verdict is the one that governed delivery. Authentication results are inputs to a filtering decision, not the decision itself.

Why Mail From Your Own Address Reads as Safe

The reflex assumption about self-addressed mail is that it is obviously wrong, that a reader would stop at seeing their own name in the From field. In practice the pattern lands differently. It does not look like an attacker. It looks like a system quirk, a duplicate, a notification your own tenant generated on your behalf, or a signature workflow that copied you. There is no unfamiliar sender to evaluate, no lookalike domain to squint at, and no named executive whose voice a careful reader might question. The platform's own impersonation flag fired on this message, but with no named target attached to it, because there was no specific person being imitated. The identity being borrowed was the recipient's own.

That absence of a hostile-looking surface is the point. The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breaches as the initial access vector and credentials in the picture for 39% of breaches across the full kill chain, which is the pairing on display here: a low-friction delivery trick feeding a credential capture page. NIST defines phishing in terms of the deception rather than the payload, and the deception in this case is structural. It lives in two header fields.

See Your Risk: Calculate how many threats your SEG is missing

One Borrowed Hop Between the Button and the Landing Page

The "Start signing" button did not point at the attacker's page directly. It pointed at a link-tracking hostname belonging to monday.com, a real collaboration platform whose tracker endpoint forwards a click to whatever destination the link generator encoded into its token. That token is a signed JWT, and decoding it returns an originalUrl value pointing at a disposable third-level host on a throwaway [.]vu domain, sharedfile[.]realestatecotblrp[.]vu.

The vendor here is a bystander. Nothing suggests its infrastructure was compromised; a redirect service that faithfully forwards a supplied destination will faithfully forward a hostile one. What the borrowed hop buys the attacker is the first impression: a recognizable vendor hostname, a valid certificate, and a reputation the attacker did not have to build. It also splits the verdict. Scanning the tracker URL returned a mixed and partial result, while scanning the final landing URL returned clean, which is the answer you tend to get when an interactive credential page declines to render anything interesting for an automated fetch. Two hops, two inconclusive verdicts, one credential form waiting at the end.

The Signal Was the Shape of the Header, Not the Payload

There was no attachment to sandbox, no macro, no executable, and no obviously malicious string in the body. What was available to analyze was behavior. Themis, the IRONSCALES Adaptive AI analyst, scored the message at 90% confidence and labeled it credential theft, on two signals. The first was the link. The second was the sender pattern itself: an external sender using an internal-looking address to write to itself, with a suspicious link attached, which is the recognizable shape of a Direct Send phish regardless of what the authentication headers happen to say. That is a judgment about the geometry of the message, and it survives an attacker who has no payload to hide.

The stakes behind a single harvested advisor credential are not theoretical. The 2025 FBI IC3 Annual Report records $3,046,598,558 in reported business email compromise losses, and a working mailbox at a firm that moves client money is exactly the foothold that math is built on. Credential harvesting protection that reasons about sender behavior, not just link reputation, is what closes the window between delivery and the first click.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link covers the delivery: a single lure link, wrapped in a vendor redirector, aimed at a credential page.
• T1583.001 Acquire Infrastructure: Domains covers the disposable landing domain registered to serve one short-lived page.

What This Changes for Defenders

CISA's phishing guidance argues for controls layered underneath protocol compliance, and this message is a good argument for four specific ones.

1. Alert on inbound mail whose From address matches the receiving mailbox. This is a cheap, high-signal rule that does not depend on any authentication verdict. Legitimate self-addressed mail from outside your own infrastructure is rare enough to be worth reading every time.
2. Enforce DMARC rather than observing it. A failure with no enforcement action told the receiver exactly what it needed to know and asked it to do nothing. If your own domain is going to be worn as a costume, the policy is what decides whether that costs the attacker anything.
3. Do not treat a composite verdict as a summary of the checks beneath it. When SPF fails, DKIM is absent, DMARC fails, and the composite result is a pass, the composite result is not summarizing that evidence. Alert on the disagreement itself.
4. Resolve vendor link trackers before trusting them. A recognized SaaS hostname in a link is a statement about the redirector, not about the destination. Decode the token and evaluate where the click actually terminates.

None of those four require knowing anything about this particular campaign. They require treating the shape of a message as evidence, which is what was left once every authentication check in the chain had already been failed and overruled.