The Quoted Thread Still Had Open Grammar Flags In It

In late January 2026, the accounting mailbox at a small consumer personal-care services business received the tail end of a conversation it had never had. Three lines of new text sat at the top: the invoice is approved, please pay via ACH, signed with the display name of the company's own principal. Underneath sat a quoted invoice thread, two messages deep, attributed to the accounting team of a well known CRM vendor and dressed with that vendor's genuine published San Francisco address. The brand had nothing to do with it; its domains appear nowhere in the headers. There was no attachment and no credential page: the quoted history was the whole payload, and it arrived carrying the state of the editor it was written in.

What Rode In With the Quoted History

Sixteen paragraphs of the supposed received thread each carried a unique data-wt-guid identifier alongside the utility classes pb-2 and min-w-[1px]. They begin at the first quoted header line and run to the foot of the thread. The attacker's own three lead paragraphs above use ordinary inline mail-client styling, so the convention changes exactly where the quoting begins.

Nine wrappers built on a non-standard element named wt-ignore survived into the delivered HTML, each with its own UUID and a source attribute reading wt-feature-result. They sit around the load-bearing pieces of the story: the two timestamps, the word Invoice, and the phrase about the attached invoice. It renders as an inert wrapper no mail client knows, invisible to the reader.

Five grammar flags were still open, each an issue-underline span with a data-issueid UUID, a data-testid, and an accessibility label beginning with the words open issue for the following text. Three hold a data-testid whose value diverges from the text rendered inside the span, most visibly a value reading PAST DUE in capitals over rendered text reading 'Past due'. A fourth reads simply undefined. Which member of each pair was the tool suggestion and which the operator's own wording is not recoverable from the bytes; what is recoverable is that the span kept a second, divergent variant of the phrase it wraps, inside a block claiming to be mail somebody else sent. The namespace on these attributes identifies a class of browser-based writing-assistant editor and nothing more: it names no product and records no generative act.

What That Markup Proves, and What It Does Not

The residue proves the quoted block passed through the attacker's composition surface in the same session as the new prose above it. Per-paragraph identity attributes and unresolved editorial flags are authoring state: they exist while text is being worked on, and are discarded when an editor exports text rather than its live document tree. Bounded to the quoted region while the prose above uses a different convention, they mark a composition boundary.

It does not prove the thread was fabricated. Had the operator stolen a genuine thread from a compromised mailbox and pasted it into the same editor, that paste would acquire the same identifiers and the same open flags. The markup is silent on where the words originated; it speaks only to where they were last handled. Collapsing those two statements into one is the only way this analysis becomes wrong. A markup read is enough to freeze a payment instruction, not enough to say whether a real conversation elsewhere was compromised.

See Your Risk: Calculate how many threats your SEG is missing

How the Thread Was Shown To Be Invented

Fabrication was settled from content alone. Both supposedly distinct quoted messages carry the identical timestamp 12:14 PM. Both are addressed from the same vendor accounting team to the same recipient, so the outer one has a vendor forwarding its own message to the person who already had it. The quoted subject cites one invoice number while the live subject header cites another, and the company named in that live subject appears nowhere in the body. One quoted date string is missing the space between weekday and month, a hand-editing artifact. And the text claims an attached invoice twice while the record holds zero attachments. There was never an invoice. Both weekday and date pairs are internally correct: the dates are not impossible, only duplicated to the minute.

Reading inconsistencies like these is the established way to expose a business email compromise thread. The point is that the markup read got there first, and that an operator who tidies up his timestamps still cannot tidy up the document tree he pasted. Nor is this the familiar unfilled kit placeholder, evidence about a delivery template somebody bought. This is the operator's own composition surface, recording unresolved editorial decisions inside the block that claims to be received mail.

Why Nothing Failed an Authentication Check

Every check passed, because the attacker owned every identity being checked. The sending domain was registered on 2026-01-15, eleven days old at send. He authenticated it inside a bulk-mail provider, earning a DKIM signature on his own domain, and published his own DMARC record at p=none so alignment would pass; SPF passed on the provider's bounce domain. A lookalike registered four days later on identical nameservers appears only as the visible text of the single link, its destination never resolved. The transport appended a working one-click unsubscribe pair per RFC 8058 and an industry complaints address, because that is what the provider's pipeline does to every customer message.

None of that is exotic: the 2026 Verizon Data Breach Investigations Report puts phishing at 16% of initial access vectors and pretexting at 6%.

Triage the Quoted Region as Markup, Not as Prose

Themis returned a confidence of 53 with no label, and the SOC narrative analysis never completed. A human closed it as malicious, and the message was quarantined. What surfaced it was relationship context: the cloned display name matched the company's own principal, the message arrived from an unrelated domain, and there was no prior correspondence in either direction at that tenant. Our Adaptive AI weighs that graph precisely because authentication had nothing left to say here.

Two things to do with that:

1. Hunt inbound HTML for authoring attributes inside a quoted region that the prose above does not share: per-paragraph identity attributes, non-standard inline wrappers, labels describing unresolved suggestions, any attribute holding a variant of the visible text. A change of styling convention at the quote boundary is evidence in itself.
2. Verify every change to payment instructions out of band against a contact record you already hold. The payload here was three lines of prose and a story, with nothing for a scanner to open. Our business email compromise protection exists for the messages with no artifact to detonate.

CISA makes the same structural point in its phishing guidance, and NIST defines the underlying technique by deception rather than payload. A quoted thread is a claim, not a record, and sometimes the claim is signed in the markup.

Indicators of Compromise

Detection strings, deliberately not indicators of compromise: data-wt-guid, the wt-ignore element with its wt-feature-result source attribute, the issue-underline span with its data-issueid and data-testid, and the class pair pb-2 and min-w-[1px]. They identify a commercial editor's markup, not attacker infrastructure. Hunt on them, never block on them.

MITRE ATT&CK Mapping