A Fake McAfee Bill From a Domain the Attacker Owned

The subject line read Completed #MCAF09471502515 has been successfully processed. The display name was ebilling- services, stray hyphen and stray space included, and the address behind it was healtylegal@fulls[.]ineave[.]cl, with the local part misspelled in a way that a real billing platform never manages. The body announced that a McAfee Total Protection plan had renewed for $299. A DOCX invoice was attached. A U.S. phone number sat underneath, offered as the way to dispute a charge nobody had approved.

One mailbox at a regional public water utility received it. There was no link to click and no macro to enable. And the most useful thing about this message is not the lure. It is the fact that every authentication check on it came back clean, and correctly so.

Nobody Spoofed Anybody Here

SPF passed. DKIM passed with a verified signature. DMARC passed with alignment intact. Microsoft's composite authentication returned compauth=pass reason=100, the strongest verdict it issues. And the sending subdomain published a DMARC policy of p=reject, the strict setting that instructs receivers to refuse delivery of anything that fails.

Read that stack the way triage usually reads it and you conclude the sender is legitimate. The correct reading is narrower and much less comforting: the attacker owns the domain.

The sending subdomain fulls[.]ineave[.]cl carried its own SPF record, its own DKIM selector and its own DMARC policy. Those are not artifacts a spoofer can forge from outside. They are DNS records, and only whoever controls the zone can publish them. The registrable domain ineave[.]cl sits on the Chilean country-code namespace, was created over a decade earlier, and is registered to a small Chilean IT services company. Bought, inherited or quietly taken over, the operator had authoritative control of that zone.

The mail path shows the same discipline. SPF passed for 209[.]85[.]167[.]54, a Google outbound host, with the envelope sender aligned to that same subdomain, and DKIM verified against a signature signed by it. No shady VPS, no forged header, just a mainstream provider carrying mail for a domain the sender genuinely owned.

The strict policy is the detail worth sitting with. A p=reject record is normally read as a maturity signal, and here the attacker published it to buy exactly that reaction. Nothing in RFC 7489 claims that an authenticated message is truthful. It establishes custody of a domain, and this attacker had custody. MITRE ATT&CK tracks the move as T1583/001, acquiring domain infrastructure.

The Invoice Was Generated, Not Written

The attachment was named SKU#MCAF66682714616.docx, weighed 1,073,110 bytes, and scanned clean. That verdict was accurate too. No VBA macros. No OLE embedded objects. Three PNG images under the document's media directory and a body of text. Nothing to detonate in a sandbox.

The document's own metadata is where it falls apart. The generator string does not name Microsoft Word. It names SautinSoft.Document, a .NET document-automation SDK developers use to produce Office files programmatically from server-side code. The creation and last-modified timestamps sit roughly one minute apart, which is not how a human drafts an invoice. Inside the file are malformed, concatenated URL strings and a reference to a local API endpoint on hxxp://127[.]0[.]0[.]1:30030/_api/html/ followed by a UUID path segment, the residue of an HTML to DOCX conversion running on the attacker's own machine. The extracted text also contains the bare string ssn, a template field left in place.

The attachment is therefore not a document but a build artifact. Somebody wrote an HTML invoice template, pointed a conversion service at it, and let it stamp out files. Assembly lines imply volume. The clean verdict is not reassurance, it is the design goal, because a file that carries only typography and a phone number is invisible to every control that looks for code.

See Your Risk: Calculate how many threats your SEG is missing

The Visible Recipient Was a Decoy

The To: header addressed noreply_emails09471502515@harris11111970hxf[.]com, a throwaway address on an unrelated domain that nobody at the utility had ever corresponded with. The actual target was reached only through a blind copy.

That small trick has two useful effects. It breaks the reflex of checking whether a message was really addressed to you, because the visible answer is that it was addressed to somebody else. And it lets one body be fanned out across many blind recipients without exposing the list. The message travelled through a Barracuda cloud gateway and into Microsoft 365 without the visible envelope ever naming its real target. Two Microsoft links in the body were not attacker infrastructure either, but Microsoft's own automatic first-time-sender safety notice.

The Phone Number Was the Whole Attack

Everything above exists to get a person to dial +1-803-900-9333 or +1-803-900-9348. There is no credential harvest, no landing page, no hosted kit. The 803 area code is South Carolina, which sits oddly against a sending domain on the Chilean namespace, and that mismatch is one of the few free contradictions the message hands you.

This is vishing, the callback pattern often shorthanded as telephone-oriented attack delivery, and it inverts the usual urgency. No deadline, no threat. The email simply reports a charge and offers to reverse it. For somebody who never bought consumer antivirus on a work account, calling to cancel is the responsible-looking response, and the moment the call connects the attack has left the inbox. On the line the operator runs a refund script: install remote-access software to process the reversal, read me the card, confirm the account for the credit. MITRE catalogs the shape as T1566/004, spearphishing voice and T1598, phishing for information, with the fabricated vendor bill falling under T1656, impersonation. The 2023 FBI IC3 Internet Crime Report put reported business email compromise losses near $2.9 billion, and the 2024 Verizon Data Breach Investigations Report places pretexting at the top of the social-engineering breach types with a median transaction around fifty thousand dollars. Neither number comes from anything a scanner could have quarantined.

What Actually Flagged It

With clean authentication, a clean attachment and no URL to condemn, detection had to come from identity and behavior. It did. The sender was writing to this organization for the first time. The claim was financial and unsolicited. The only call to action was a telephone number, the document was machine-generated, and the visible recipient was fictitious. IRONSCALES Adaptive AI weighed that combination against similar callback fraud reported across a community of 35,000+ security professionals across 17,000+ organizations, and Themis surfaced the message at 88% confidence with a vishing label. It was automatically resolved as phishing and quarantined at the same moment it arrived, with no analyst required to adjudicate it. CISA's phishing guidance makes the same argument: the cycle has to break before the human decision, not after the file scan.

The lesson is narrow and worth repeating whenever an all-pass authentication result gets treated as an exoneration. SPF, DKIM and DMARC answer one question: did the party that controls this domain send this message. When the answer is yes and the party is the attacker, every check is working exactly as specified, and it has told you nothing at all about the invoice.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1583/001, Acquire Infrastructure: Domains. The attacker owned the sending domain and published its authentication records.
• T1566/001, Spearphishing Attachment. A generated DOCX carried the lure without carrying code.
• T1566/004, Spearphishing Voice. The callback number was the only call to action.
• T1598, Phishing for Information. The call script extracts payment and account details.
• T1656, Impersonation. A fabricated McAfee renewal from a sender unrelated to the brand.

See You Next Time

Authentication proves custody, not honesty. When the sender owns the domain, an all-pass result is the beginning of the investigation rather than the end of it.