The Invoice Scam That Came With an Unsubscribe Link

The message came with a working unsubscribe link. Not a fake one, not a tracking pixel dressed up as one, but a genuine one-click unsubscribe footer generated by a real mailing-list platform on behalf of a real company. It also came with passing SPF, passing DKIM on two separate domains, passing DMARC, and a Microsoft composite authentication verdict recorded as a pass on explicit authentication. Everything a filter looks for when it asks whether a message is legitimate bulk mail answered yes.

Inside that envelope was a fabricated email thread instructing a payment approver at a regional financial-advisory firm to settle an invoice without delay.

That inversion is the whole case. The compliance signals were not defeated, bypassed, or spoofed. They were the disguise.

Legitimate Bulk Mail, All the Way Down

The sending domain was registered in 2009 and has been in continuous use ever since by an established business with no connection to the recipient. Its bulk mail goes out through a mainstream transactional email service, and this message went out the same way: SPF passed against the company's own sending subdomain on that platform, DKIM passed for both the platform's signing domain and the company's own, and DMARC passed with the company's published policy applied. None of that was forgery. Under RFC 9989, the current DMARC specification, alignment establishes that the domain owner authorized the message. It makes no claim about whether the content is true.

The headers went further than authentication. The message carried the full commercial mailing-list apparatus: a list identifier, both mailto and one-click unsubscribe endpoints, a header advertising RFC-compliant one-click unsubscribe support, list archive, owner, post and subscribe endpoints, a bulk precedence marker, and campaign and mailing-list identifiers. This did not merely resemble list mail. It rode through the company's actual list infrastructure.

The most likely explanation is that the attacker got into that bulk-mail account, either through the sending platform or through the company's own credentials, and used it as a launcher. The record shows genuine passing authentication for a long-established domain. It does not show how the account came to send this, so the company that owns the domain is a bystander here, not the attacker. Anyone blocklisting that domain in response would be punishing the second victim.

A Paper Trail That Never Happened

The visible sender name matched a named financial advisor at the recipient's own firm, exactly, while the address behind it belonged to the unrelated sending company. That single mismatch was the only forgery in the message, and it was the one a busy approver was least likely to expand and read.

Below it sat a fabricated conversation. Two quoted messages, one dated in early June and one in late July, staged an exchange between that advisor and a contact at an outside business-coaching company, walking through an engagement and arriving at an amount owed. Neither message ever existed. Quoted history inside an email body is just text the sender typed, and this thread was built specifically so that the final instruction, process the payment without delay, would read as the natural end of a conversation the recipient had simply not been copied on until now.

This is pretexting in the strict sense: no attachment, no credential-harvesting page, no malicious link at all. The 2026 Verizon Data Breach Investigations Report tracks pretexting as six percent of initial access vectors, while phishing is the initial access vector in sixteen percent of breaches, and it finds the human element involved in sixty-two percent of breaches overall. The 2025 FBI IC3 Annual Report puts reported business email compromise losses at $3,046,598,558, and cases like this one are why: the entire payload is a sentence about money, delivered with enough context to feel routine.

Invisible Characters Between Every Letter

One supporting detail is worth naming. Pulled as raw bytes rather than as rendered text, the body turned out to have a U+200C zero-width non-joiner inserted between every single letter, including inside the fabricated quoted messages. On screen the text reads normally. To anything matching on literal strings there is no word "payment", no phrase "without delay", and no recognizable invoice vocabulary anywhere in the message, because no two letters are adjacent. It is a cheap, mechanical way to blind keyword-based inspection, and combined with clean authentication it removed most of the signals a gateway would otherwise score.

Two Reply Paths, One Fresh Domain

The reply path was doubled. One reply address sat on the coaching company's real-looking domain, matching the persona quoted in the fabricated thread. The other sat on a domain registered in the middle of August, a matter of days before this message was sent, through a registrar offering privacy protection, with a name chosen to read like generic cloud email infrastructure. Whichever address the approver hit, the attacker had a live mailbox waiting to continue the negotiation, and that fresh domain is the only genuinely attacker-owned asset in the entire chain.

See Your Risk: Calculate how many threats your SEG is missing

What Actually Flagged It

With authentication clean, the body unreadable to keyword matching and the sending domain seventeen years old, the usual signals were exhausted. What surfaced it was relationship context. Themis scored the message at 90 percent confidence and labeled it suspected malicious content, driven by two independent inputs: an exact match between the visible sender name and a known internal contact whose real address is on a completely different domain, and community reputation, where resolutions of closely similar incidents elsewhere pointed the same way.

The follow-through confirmed the shape of the campaign. No action was recorded on the originally reported mailbox, but four more mailboxes at the same organization subsequently received near-identical variants with subjects like "Please Review Payment" and "Payment Schedule Reminder", and those were quarantined. A single targeted send does not usually arrive five times. A hijacked list account, sprayed across whatever addresses the attacker held for one organization, does.

The defensive lesson is narrow and practical. Authentication results, unsubscribe compliance and sending-domain age are all statements about the delivery route, not about the request. Guidance from CISA on interrupting the phishing attack cycle and the NIST definition of phishing both frame the target as the person and the process, not the transport. If a message asks you to move money, the control that works is verifying the instruction out of band against a contact record you already hold, before the invoice number ever gets typed into a payment run.

Indicators of Compromise

MITRE ATT&CK Mapping

Sources referenced above: the 2026 Verizon Data Breach Investigations Report, the 2025 FBI IC3 Annual Report, CISA phishing guidance, the NIST definition of phishing, and RFC 9989.