The Relay Flagged It Bad and Delivered It Anyway

A message with the subject Project Meeting arrived in a mailbox at a logistics technology provider. The sender name presented the recipient's own employer in capitals, followed by the word Meeting. The address beside that name was a generic meeting alias on the company's own domain. Neither belonged to the company.

The header From resolved somewhere else entirely: a real employee mailbox at an unrelated packaging manufacturer, a business with no correspondence history with the recipient.

And sitting in the same header block, written by the relay that carried the message rather than by the attacker, was a status field whose value was Bad. The relay that delivered this message had already concluded something was wrong with it.

A Calendar Part That Rendered as a Recording Alert

The lure was not an HTML body in the ordinary sense. The message carried a base64 encoded calendar part, the same MIME type a genuine meeting invitation uses, and the decoded content was styled as a notification that a Teams meeting recording was ready to view. One button, labeled OPEN. No attachment, no second link, no signature block.

Two things follow from that packaging choice. The first is inspection. Text based content analysis tuned for HTML bodies has materially less to grade when the payload arrives as encoded scheduling data, and the outer message carries almost no visible text of its own. The second is rendering. Mail clients treat calendar content as a special object and wrap it in scheduling chrome, which reads as machine generated rather than as prose someone typed. A recipient who has accepted the frame of a calendar notification has stopped evaluating the sender.

There was also no meeting. The recording alert referenced a session the recipient had never attended, from an organizer who did not exist, on a calendar the sender had never been invited to.

The Relay Wrote Its Own Verdict Into the Headers

The authentication block looks unremarkable on a fast read. SPF passed for the packaging manufacturer's domain from an egress IP belonging to a large shared outbound relay service. There was no DKIM signature at all. DMARC passed on SPF alignment alone, under a policy of none. Microsoft's composite authentication returned a pass with reason code 100, the value it reserves for a message that satisfied every identity check the service knows how to run.

The mechanism worth understanding is the SPF include. When a domain authorizes a large shared relay, it does not authorize one account on that relay. It authorizes the relay's whole outbound estate, because the published record is a list of IP ranges and the relay's customers all share them. Any account able to submit mail through that service can therefore produce a passing SPF result for any domain that includes it, without compromising a mail server, buying a domain, or forging a single header.

The relay operator knows this, which is why it stamps its own trace header on outbound mail. On this message that header carried the value Bad, indicating a mismatch between the authenticated account that submitted the message and the domain the message was claiming in its From header. The relay saw the contradiction, recorded it, and delivered the mail regardless. The receiving tenant read the SPF pass, read the DMARC pass, treated the relay's header as ordinary trace data, and delivered it too.

That is the whole gap in one message. A verdict existed. Nothing in the delivery path was configured to consume it, and DMARC monitoring would not have surfaced it either, because the domain's own policy of none meant even an alignment failure carried no instruction to act on.

One Query Parameter, One Named Target

The OPEN button was wrapped in a link protection style rewrite before it reached the recipient, which is a trust signal in itself: a scanned link that was not blocked reads to most people as a link that was checked and cleared.

Its final destination was a bare serverless function URL on a major cloud provider, in that provider's us-east-1 region. A random thirty two character function identifier, the provider's own domain, no path that resembled a meeting, no branding of any kind.

The interesting part is what rode in the query string. A single parameter carried the recipient's own email address, base64 encoded. That value is withheld here for the obvious reason, but its presence answers a question a bare link cannot. This was not a blast to a purchased list with one shared landing page. Each recipient got a URL built for them, which lets the credential page prefill the account name and present itself as a session that already knows who is arriving. It also doubles as delivery confirmation the moment the page loads.

The defensive blind spot is worth naming. Encoded parameters do not read as addresses to plaintext scanning, so the strongest evidence of targeting in this message is also the least likely to be noticed by tooling.

See Your Risk: Calculate how many threats your SEG is missing

The Signal That Caught It

Adaptive AI scored the message at 90 percent confidence for credential theft, and the case was automatically resolved as phishing without waiting on an analyst. Ninety percent is worth reporting honestly as what it is: high, and reached from behavioral signals rather than from a failed technical control, because no technical control failed.

The signals available were relational. A sender with no correspondence history. A display identity asserting the recipient's own employer while the address belonged to a company in an unrelated industry. A calendar object from a party with no scheduling relationship to the recipient. A destination unconnected to either organization or to any meeting platform. The NIST definition of phishing turns on deception and objective, both of which this message supplied while passing every check designed to establish who sent it.

Three Changes Worth Making

The 2024 Verizon Data Breach Investigations Report puts the human element in 68% of breaches, phishing in 15%, and stolen credentials in 38% as the top initial action, with a median of 21 seconds to click a phishing link and 28 more to submit data on the page behind it. Messages that satisfy the identity layer instead of evading it are what keep those numbers steady.

Three practices follow. Parse third party relay verdicts instead of consuming only their SPF outcome, because a relay that flags its own mail has handed you a scored signal for free. Treat calendar parts as content to be inspected rather than as scheduling metadata to be rendered. And score the shape of a link's query string, since a parameter that encodes the recipient's own identity is a targeting artifact no legitimate notification needs. Credential harvesting defenses that stop at the authentication result, as CISA's phishing guidance warns, will keep passing mail that is technically authentic and substantively false.

Indicators of Compromise

MITRE ATT&CK Mapping