A Fake Procore Alert Pasted Into a Stolen Newsletter

The email that reached a regional member-owned credit union was, in almost every byte, somebody else's mail.

Its body was a verbatim copy of a consumer hobbyist magazine's subscriber newsletter: thirty-nine of the publisher's own click-tracking links intact, twenty-eight images still loading from its CDN, the editorial headlines and share buttons all authentic. Every one of those assets scanned clean, because every one of them was real.

Exactly two things in the message were fabricated. One was a card pasted above that newsletter, styled as a Procore notification. The other was a single href.

Four mailboxes across two domains belonging to the same credit union received copies. All four were quarantined.

The One Card That Did Not Come With the Newsletter

The injected block presented itself as Procore Global Enterprises and led with a line reading "You have 1 overdue Req Action." It greeted the recipient by first name, referred to an "Attached Revised Closing remittance for April & Review", printed a due date matching the send day, and offered one button, "View Message".

Everything around that button was genuine: Procore's real support mailbox at support@procore[.]com, a working link to hxxps://support.procore[.]com, the brand's actual corporate address, and an unsubscribe line pointing at a company administrator.

The pretext was incongruous in a way nobody reads closely enough to catch: a construction platform's overdue-task notice to lending staff at a financial institution, riding on a hobby magazine's newsletter. MITRE ATT&CK files that dressing as impersonation and as matching a legitimate name. The platform's own impersonation detector never fired, because nothing in the headers claimed to be Procore: the brand existed only as text and images inside a rendered body, where header-level identity logic has no window.

The Attachment That Was Never Attached

The card said a revised closing remittance was attached. The message had no attachments at all.

That is the design, not a slip. A reader who cannot find the promised document has one way forward left, so the claim manufactures the click and deletes the attachment-inspection surface. CISA's phishing guidance frames the pretext and the requested action as the pair worth disrupting, and this message had reduced itself to exactly those two, wrapped in borrowed camouflage.

Authenticated by a Manufacturer That Never Sent It

The envelope was genuine and belonged to somebody else entirely. Delivery came through a small Canadian manufacturer's own bulk-mail stream, out of 50[.]31[.]63[.]70 with a SendGrid reverse pointer. SPF passed, DKIM passed with a signature carrying the company's own apex domain, and composite authentication passed.

None of that is forgery, and that is the point. The manufacturer's domain was registered roughly five years earlier and belongs to a real operating business whose DNS already authorized that platform, so mail injected into the stream carries the company's real signature and aligns cleanly. The compromise sits at the provider account, not at the domain, a step MITRE files as compromising email accounts.

Then comes the line that will fool a log review. Authentication-Results records dmarc=bestguesspass action=none, and that domain publishes no DMARC record at all. Microsoft inferred one from the aligned SPF and DKIM and reported the outcome in DMARC vocabulary. RFC 7489 defines DMARC as the domain owner's published instruction to receivers, so a best-guess result is the absence of that instruction, not a satisfied one. That is why DMARC monitoring and management is an inventory problem: a queue of pass-shaped strings hides the domains that published nothing.

Two fields matched nothing at all: a Reply-To at autoreplyspm@yopmail[.]com on a public disposable-address service, and a From display name running to twenty-four stacked infrastructure nouns, long enough that most clients render only its harmless opening fragment.

See Your Risk: Calculate how many threats your SEG is missing

What the Scan Found at the End of the Button

The "View Message" href was not freshly built. It was a security-vendor URL-rewriting wrapper, a secure-web.cisco[.]com link some other organization's gateway had already generated, reused verbatim with the real destination percent-encoded inside it: a path, /macjkl, on a third-party host under the .mk country domain. That host's registration offers no creation date and its only contact reads as a real operating Macedonian business, so the likeliest reading is a compromised legitimate site, which MITRE files as compromised infrastructure. The tenant's own Safe Links rewriter wrapped that in turn, leaving three nested vendor redirects around one destination.

The platform did unwrap and scan it. Two link records exist for the injected path, and both came back clean. The captured screenshot explains why: the page that rendered was a consumer social-platform sign-in screen, with a "Happening now." headline, third-party continue buttons, an email-or-username field, and a scan-to-get-the-app code panel. Both snapshot files for that host are named after that platform's domain, and this scanner names snapshots after whichever host a link resolves to.

Whether that path forwards to the real service or serves a lookalike is not settled by the record, and the screenshot carries no address bar. Either way, across ninety-nine extracted link records not one verdict came back malicious. That is the ceiling on scoring hops individually, and the case for URL and malware attack protection that scores a chain's shape rather than any single fetch.

Four Mailboxes, Four Different Subject Lines

Each copy carried its own subject, randomized with alphanumeric filler: a closing-confirmation reference, a request-closing-summary submission line, a document follow-up, each tagged with a different opaque token. Random per-recipient tokens defeat exact-subject clustering, which is how a small burst stays under the threshold that would group it.

The reply framing was cosmetic too: Thread-Index and Thread-Topic headers present and subjects prefixed to look like replies, but no In-Reply-To or References header anywhere, and no urgency markers either. A second wave hit three more mailboxes the next day, quarantined in seconds.

Behavior Carried the Verdict, With One Wrong Citation

With every mechanical check returning a pass, the decision fell entirely to how the message behaved. Our Adaptive AI scored it at 81% confidence, labeled it for credential theft and for a high-value recipient, and weighed language and structural cues against community signal. The incident resolved automatically as phishing and all four copies were quarantined.

The reasoning deserves a footnote. Themis cited a link it had flagged as malicious, and that link was the copied newsletter's legitimate view-in-browser tracking endpoint, not the injected button. Correct verdict, wrong artifact, and worth logging rather than glossing: an analyst reading that explanation would pull a harmless link and might clear the message. The 2024 Verizon Data Breach Investigations Report puts the median time from opening a phishing message to clicking its link at twenty-one seconds, a budget that does not accommodate chasing the wrong indicator. NIST defines phishing around deception rather than the forgery of a technical identifier, and this message never forged one.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002, phishing via spearphishing link, one injected button inside borrowed newsletter content
• T1656, impersonation, a fabricated platform notification carrying the real brand's support contacts and corporate address
• T1586.002, compromised email accounts, delivery through a real company's authorized bulk-mail stream
• T1584.001, compromised infrastructure, an injected path on a third-party host that appears to be a legitimate operating business
• T1204.001, user execution of a malicious link, the only interactive element the fabricated card offered
• T1036.005, matching a legitimate name, brand identity constructed entirely from real published details

The Takeaway

Three assumptions break at once. That a body full of verifiably clean content is worth trusting, when the clean content was stolen wholesale so the two fabricated elements would be a rounding error inside it. That a pass-shaped authentication line is a pass, when a best-guess result means no policy was ever published and the alignment that succeeded pointed at an uninvolved company. And that a clean verdict on the destination closes the question, when the scanner's own fetch returned a mainstream login screen with no business at the end of an invoice notice. What gave this message away was none of its parts, but the arrangement: a construction-platform alert, in a hobby magazine's newsletter, from a small manufacturer's mail stream, replying to a conversation that never happened, about a document that was never there.