The DocuSign Button That Went to a Link-in-Bio Page

The email said a nondisclosure agreement had been executed. It carried the layout, typeface and completion language of a DocuSign notice, telling the reader all parties had signed, above a button marked "VIEW COMPLETED DOCUMENT" and a thirty-two character string presented as a security code.

The button did not point at any DocuSign domain. It did not point at a typosquat, a homoglyph, a freshly registered lookalike or a hijacked content management system. It pointed at a profile on Linktree, the consumer link-in-bio service that musicians, restaurants and independent shops use to park a list of links behind one URL. The scanner fetched it and rated it clean, which was correct. Linktree is not malicious infrastructure. Somebody signed up for a free page.

That is the entire problem with this one. There is nothing in the chain worth blocking.

No Attacker-Registered Asset Anywhere in the Chain

Run the standard playbook for a brand-impersonation lure. Identify the destination domain, check its creation date, its registrar, its reputation, add it to the blocklist, push the block. Every step assumes the attacker owns something. This attacker owned an account. The apex domain is a working SaaS product in daily legitimate use by a very large population, so blocking it costs real business traffic and no reasonable team will do it. The profile path underneath is blockable in the narrow sense that a single string can be denied, but it is free, instant and disposable, and by the time a path-level block is distributed the campaign has another one.

MITRE ATT&CK files the delivery as spearphishing link and the mismatch between the branded button and its true destination as masquerading, with the click as user execution. None of those requires attacker-controlled infrastructure. CISA's phishing guidance makes the same point defensively, that these campaigns win on presentation rather than infrastructure, and NIST defines phishing around deception rather than forgery of any technical asset.

What the profile page served was never captured. The record holds the scanner's verdict and metadata for that URL and nothing about its contents, so the honest account stops at the destination. A link-in-bio page is a redirect layer by design, but nothing here establishes what sat behind it.

A Signature Request Glued to Someone Else's Travel Receipt

Directly beneath the e-signature styling, inside the same body, the message continued into something unrelated: a complete airline trip confirmation and payment receipt. Itinerary, seat assignments, baggage fee schedule, a corporate mailing address in the footer, and eight working links to genuine airline marketing, booking and mobile-app destinations, every one scanned clean.

None of that was fabricated. The receipt carried two real passengers' names, a booking reference, ticket numbers, partially masked loyalty numbers and the last four digits of a payment card, none of it connected to the targeted organization. Those details are omitted here in full rather than abbreviated. They belong to bystanders exposed only because their receipt ended up pasted inside a phishing template, most likely through a purchased or reused mailing list. The airline was not compromised and its links were not weaponized. Its legitimate mail was recycled as filler.

The platform's link analysis called that filler templated noise and plausible content scaffolding, which is exactly its function. One unfamiliar destination among eight reputable clean ones scores very differently under ratio-based analysis than one sitting alone, and the padding gives the body the shape of ordinary bulk commercial mail, the traffic class filtering pipelines are tuned to pass.

See Your Risk: Calculate how many threats your SEG is missing

Softfail, No Signature, No Policy, and a Passing Verdict

The recipient was a multi-brand staffing and workforce solutions company, and the message claimed to originate from one of its own mailboxes, the organization's senior finance executive. The origin address, destination address and return path were identical, a self-addressed message from the finance office to itself.

Authentication told a consistent story and stopped short of a conclusion. SPF returned softfail, because the originating host was not listed in the company's published record, which ends in a soft-fail qualifier rather than a hard one. There was no signature at all, even though the domain publishes selectors. And the domain publishes no DMARC record, so no policy existed to enforce alignment or demand a report. The originating host had no reverse DNS entry either.

Read together, that leans toward header and envelope spoofing rather than a compromised mailbox. A hijacked account usually sends from infrastructure its own domain authorizes, so it passes SPF and typically arrives signed. This one did neither. The record does not settle the question, and it is worth saying plainly that it does not. Either way the domain was registered in 2004, nothing like throwaway attacker infrastructure.

The composite authentication verdict passed regardless, and that is the detail to carry out of this section. A provider-side composite pass blends reputation and behavioral signals with domain authentication, so it can return a positive result while SPF softfails, no signature exists and no policy is published. It is not a cryptographic statement about the sender. A published policy would not have stopped this message either, which targeted the domain's own users, but DMARC monitoring would have made the forgery visible in reporting.

One Template, Three Mailboxes, Five Weeks

Nothing in the authentication chain blocked this, so behavior had to. Our Adaptive AI scored the message at 84% confidence, community signal from similar resolved incidents added weight, and sender analysis flagged inconsistencies. The platform resolved it as phishing automatically and quarantined it without an analyst opening the case.

Then it came back. The same body template, identifiable by the identical hard-coded security code and button wording, struck a mailbox at an affiliated brand domain roughly four weeks later, then that mailbox again plus a third at a second affiliated domain a week after that. Four instances, three mailboxes, three brand domains under one parent, all quarantined. The later sends dropped the signature pretext and wore a trip-confirmation subject instead, reusing the padding as the lure.

That recurrence is the practical case for treating a fabricated security code as an indicator. It has no function, so it is never regenerated, so it fingerprints a kit across sends that share no sender, no destination and no timing. The 2026 Verizon Data Breach Investigations Report ties 62% of breaches to the human element and puts credentials in play across 39% of them, and frames AI's role here as operational, attackers scaling known techniques rather than inventing new ones. A free consumer profile, recycled receipt padding and a spoofed executive address are all known techniques. Catching a repeat template aimed at finance roles is work business email compromise defense has to do on behavior, since RFC 9989 governs alignment and never intent.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002, phishing via spearphishing link, delivered as a branded completion button
• T1036, masquerading, DocuSign presentation wrapped around a consumer-platform destination
• T1204.001, user execution of a malicious link, the sole interactive element in the lure block

The Takeaway

The habit that breaks here is assuming a brand-impersonation lure gives you something to block. It did not. The destination was a free page on a platform no organization can reasonably deny, the sending domain was the target's own, and the only attacker-controlled artifact was an IP address that rotates. Two things still worked. The template repeated verbatim across five weeks, which makes a fabricated security code more useful than any domain in the chain, and a self-addressed message from a finance executive that softfails SPF, arrives unsigned and lands from a host with no reverse DNS is behaviorally wrong no matter how clean its URLs scan.