Fake HubSpot Partner Invoice, Recycled Phishing Kit

One mailbox at a regional agricultural commodities (dry edible bean) processing company received an email with the subject "Phase 1 of the HubSpot engagement." It passed SPF, DKIM, and DMARC with full alignment. It carried no credential-harvesting page, no clickable payload, and no attachment that survived capture. The display name belonged to a real company executive the recipient knew, and beneath the vendor pitch sat a quoted message from that same executive approving the payment. Every layer was built to survive inspection by a gateway and by a human reading quickly.

The visible signature block claimed the sender was a HubSpot Elite Partner trading as Urban Select LLC. The raw markup of the message said something else entirely.

The Title Metadata Named a Different Agency

Inside the HTML of the message, the document title element (the string a browser would show in a tab, invisible in a normal mail client) named a real, established HubSpot Elite Partner agency with no connection to this campaign. It was paired with an invoice number carrying that agency's initials as a prefix.

That is not the company named in the signature. It is not the company named anywhere in the visible body. It is a leftover from a previous run of the same phishing kit, templated around one impersonated partner identity, then hastily re-skinned for another. The attacker updated the text a recipient would read and forgot the text only a mail parser would read.

That slip confirms the partner identity is manufactured rather than compromised. Nobody breached a marketing agency here. Someone built a reusable invoice-fraud template on a HubSpot partner theme and rotates the shell company on the front of it, which makes any organization running a HubSpot implementation a plausible target for the next re-skin.

A Real Platform Did the Delivery Work

The message came from webmasters@editions-lva[.]fr. That domain belongs to a long-registered French email marketing and newsletter platform whose outbound infrastructure was abused to relay the message, arriving through the host o1[.]ptr2652[.]editions-lva[.]fr and straight into a hybrid Exchange environment with no sanitization gateway in the path.

Authentication results were clean across the board: SPF pass, DKIM pass with the signing domain matching the sender, DMARC pass, and composite authentication scored at the maximum. Those results are accurate. They certify that the French platform really sent the message. They say nothing about whether the display name on it is honest or whether the invoice inside it is real. That distinction is the entire attack.

Reply-To pointed somewhere else again, to m@emailtifly[.]com, a third domain with no relationship to the sending platform or to the claimed vendor. Three identities, three domains, one message.

The Approval Chain Was the Payload

The body did the work usually assigned to malware. A fabricated vendor signature block from a fabricated VP of Finance persona at Urban Select LLC introduced the engagement invoice, with contact details on hubspotcrmrev[.]com, a lookalike brand domain registered barely more than a week before the email was sent. Beneath it sat a quoted message attributed to the recipient's own executive, complete with that executive's real internal address, approving the spend and instructing the recipient to route the invoice to a named internal finance contact for ACH or wire payment against a near-term due date stated in the lure.

That structure removes the two questions a finance team would normally ask. Is this vendor approved? The quoted thread says yes. Who authorizes it? The executive already did. The lookalike domain never needs to be clicked. It only needs to look plausible enough in a signature and on a remittance instruction for the money to move. Pretexting of this kind is the leading social engineering pattern in the 2024 Verizon Data Breach Investigations Report, which puts the median transaction in a business email compromise at roughly $50,000.

The Invoice That Was Never There

The body references an attachment twice, once asking the recipient to process the attached invoice and once claiming the payment remittance is also attached. The structured incident record contains no attachments at all.

That gap is worth stating plainly rather than papering over. Either the claimed PDF was stripped before capture, or it was never included and the attacker relied on the recipient replying to ask for it. The second possibility is the more interesting one, because a reply is a conversation, and a conversation is where banking details get negotiated. Treat the absence as unresolved rather than as evidence of a benign message.

See Your Risk: Calculate how many threats your SEG is missing

The Only Embedded Resource Was a Pixel

With no payload link, the sole remote resource in the body was a one by one open-tracking pixel on a tracking subdomain of the same French platform. Opening the email silently confirmed the mailbox is live, monitored, and reading vendor correspondence. For an operator running a re-skinnable invoice template, that is qualification data: which addresses read finance mail, and therefore which deserve a follow-up carrying an actual remittance form. Passive collection leaves no artifact to report and no link for a gateway to score.

Passing Authentication Is Not an Identity Check

Nothing in this message failed a technical control, which is why controls anchored to the sending domain were never going to stop it. Alignment policy published through DMARC, defined in RFC 7489, answers a narrow question about whether a domain authorized a message. The abused platform authorized it. The impersonation lived one layer up, in the human-readable display name, which authentication does not cover. MITRE ATT&CK tracks that layer separately as impersonation, and CISA phishing guidance is explicit that authenticated mail still warrants content and context review.

What flagged this was a sender fingerprint rather than a signature. Themis, the IRONSCALES Adaptive AI analyst, holds a per-recipient model of which addresses legitimately send mail under which display names. It recognized the executive's name, saw it arriving from an unrelated French platform address rather than from the internal address it has always used, and marked the message as an exact display-name impersonation at 90 percent confidence. Community resolution history on closely similar incidents reinforced the verdict. One mailbox was affected, the message was captured and resolved automatically, and the recipient was never asked to make the judgment call.

What To Take From This Case

Vendor onboarding is where this attack is defeated. A partner claim, an invoice number, and an approval quote are all free to fabricate. Banking details and vendor identities need out-of-band confirmation through a channel the email did not supply, and business email compromise protection has to weigh relationship history rather than the reputation of the sending domain. Reused kits also leave debris, so pulling the raw source of a suspicious finance email is cheap and occasionally decisive. Here one forgotten metadata string collapsed the entire vendor story.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

Authentication tells you a domain sent a message. It does not tell you the person named on it did. Check back tomorrow for the next teardown.