DMARC Said Quarantine. The Allow-List Said Deliver.

A message with the subject ACH Enrollment vendor number #00500598 w-9 forms processed landed in a branch office group mailbox at a national commercial staffing agency. The display name beside the sending address was a single word: DocuSign. The address itself belonged to a transactional-mail subdomain of a national government agency, an organization with no relationship to DocuSign and none to the recipient.

The message carried a real DKIM signature for that subdomain, and it validated. The subdomain aligned to its organizational domain, and that domain publishes a fully enforced DMARC policy. At the recipient's security gateway, SPF, DKIM, and DMARC all passed.

One hop later, at Office 365, SPF failed, DKIM failed with the reason body hash did not verify, and DMARC failed with a recorded disposition of action=quarantine.

It was delivered to four mailboxes.

A Valid Signature on a Domain With No Business Sending It

There is no lookalike domain in this case: no typosquat, no freshly registered brand string, no compromised web host. The impersonation is one word in a display name, everything underneath it is real, and every domain in the message belongs to a bystander, a shared platform, or the recipient.

The trace shows where the mail came from. A client IP submitted it into a large Asia-Pacific mail service, and it left through that provider's commercial bulk-mail egress in Singapore. The DKIM selector names that platform's Asia-Pacific region, and a feedback identifier describes a configured batch-sending stream keyed to the sending mailbox. Someone provisioned this properly, with DNS records published on the government subdomain to match. Two smaller tells sit alongside it: the Message-ID belongs to the mail platform's own domain rather than the claimed sender, and the Date header's timezone offset matches neither the submission stamp nor the relaying gateway's hop.

That configuration is why the agency is a bystander and is not named. A published key and correct alignment are the fingerprint of a genuine transactional-mail setup being abused, not of infrastructure an attacker registered, and the record does not establish how it came to be abused.

The Gateway Broke the Hash It Had Just Verified

The recipient's gateway did its job. It evaluated SPF, DKIM, and DMARC, recorded three passes, then rewrote every URL in the body into its own link-protection wrapper before relaying onward. That rewriting is documented, expected behaviour and is the reason most organizations buy the product.

A DKIM signature commits to a hash of the message body. Rewriting the body changes the body. So the gateway invalidated the body hash it had confirmed moments earlier, and the failure Office 365 recorded was generated by a victim-side control rather than by anything the attacker did in transit. The SPF failure is the same class of artifact: the last connecting IP was the gateway's own inbound delivery host, which is naturally not listed in the subdomain's SPF record.

What remained was a DMARC evaluation against a policy of quarantine on both the organizational domain and its subdomains, at full percentage, producing a fail with a disposition of quarantine and a composite authentication result of none with reason code 451.

The Allow-List Made the Failure Inert

Then the antispam report tells you why none of it mattered. The connecting IP was marked as matching the tenant's connection allow list, spam filtering was recorded as skipped, and the spam confidence level was set to negative one, meaning treated as non-spam.

The allow-list is a tenant configuration, not a vendor defect, and allow-listing a gateway's relay IPs is reasonable so that legitimate relayed mail is not scored as bulk. But the effect is unconditional: once that entry exists, an enforced quarantine policy failing at your own mail service produces a log line and nothing else. An authentication verdict is only worth what something downstream is still permitted to act on, which is why gateway augmentation has to include auditing what the gateway's presence exempts.

See Your Risk: Calculate how many threats your SEG is missing

A Document That Was Never Attached

The body advertised a file called ACH-Wire Authorization for Invoice9876545.pdf. The message carried no attachments at all. The filename is set dressing, and it stacks three finance-workflow hooks into one object: ACH enrollment, wire authorization, and an IRS Form W-9.

The credential step is pre-announced in plain text. The body states that sign-in authentication with the recipient email is required to review and electronically sign the pending document, which converts a suspicious prompt into an anticipated one. Exclusivity is manufactured the same way: the body prints a single permitted viewer address, which is the recipient's own group mailbox.

The rest is social engineering, not technique. A green badge announces a secure document received, and a yellow warning box instructs the recipient not to share the email or the link with anyone, which reads as a security notice and functions as an instruction not to do the one thing that would have stopped this. The header logo is hotlinked from a public logo-aggregator site with a CSS filter forcing it white, because the attacker never had the real asset.

Both calls to action arrived as the gateway's own rewritten wrappers, and the shorter one exposes its target in a query parameter: a tracking host on a shared transactional mail platform. Neither docusign.net nor docusign.com appears anywhere in the message. Both links were scanned and returned clean with no screenshot retained, so what sat behind them was never observed.

The Signal That Caught It

The gateway's impersonation engine scored this message both ways at once. Its VIP impersonation policy returned false on every check, including the custom display name list and the reply-to mismatch test, because those rules are built around named people, typically executives and finance staff. A one-word brand matches no person-based entry, and at the platform level the message likewise registered as neither a first-time sender nor an impersonation attempt. Only the generic threat dictionaries in the default policy fired.

What resolved it was Themis, our Adaptive AI analyst, at 86 percent confidence with the label Invoice Phishing, citing language and structural patterns commonly associated with phishing alongside community reputation from resolutions of similar incidents. The report came from the IRONSCALES community rather than from a recipient, across 35,000+ security professionals across 17,000+ organizations. Four mailboxes were affected, the incident was automatically resolved as phishing, and the whole sequence from relay to disposition ran inside a single minute.

Four Changes Worth Making

The 2024 Verizon Data Breach Investigations Report puts phishing in 15% of breaches, stolen credentials in 38% as the top initial action, and the human element in 68%, with a median of 21 seconds to click and 28 more to submit data. The 2023 FBI IC3 report puts reported business email compromise losses near $2.9 billion, and ACH enrollment and W-9 requests feed that figure.

Four practices follow. Audit every connection allow-list entry, and treat a skipped filter as a decision, not a default. Alert on the combination this message produced, an upstream authentication pass followed by a final-hop DMARC failure with a quarantine disposition and filtering skipped, which is what DMARC monitoring is for, as CISA's phishing guidance also urges. Score brands in display names, not only named individuals. And treat an advertised attachment that is not attached as a signal in its own right, because deception and objective, which is how NIST defines phishing, are both present in a document that does not exist.

Indicators of Compromise

MITRE ATT&CK Mapping