The Phishing Link That Was Only an Image

Four mailboxes at a European plastics and packaging manufacturer received the same Italian-language notice, and it followed the grammar of a cloud file-share alert exactly: a name, then ha condiviso ("has shared"), then a document title in quotes, then con te ("with you"). The document title referenced a payment transfer reference and a date, which is the sort of thing a logistics vendor genuinely sends. The name in front of it belonged to a contact at that vendor whom the recipients had corresponded with before.

Then you look for the link, and there isn't one. No underlined blue text, no button label, no visible URL, nothing in the message body that a reader could inspect before deciding. The entire call to action was a single embedded image, 496 by 490 pixels and 61,901 bytes, wrapped in an anchor tag. The picture was the link.

A call to action with nothing to read

Strip the image out and what remains is an unremarkable Italian business email with a vendor signature block. That is the point. A very large share of email inspection reads a message as text and scores what it finds there: urgency phrasing, brand keywords, a visible destination that disagrees with the sender domain, a button label that matches a known kit template. Render all of that as pixels and every one of those checks returns nothing to score, while a human reader loses nothing at all, because a person processes the picture faster than they would have processed the sentence.

It also removes the reader's last cheap defense. Hovering over text to read the real destination is the one habit awareness training reliably installs, and there is no hover on a phone and no visible string to compare anything against here. The only available action is to tap the picture.

A second image was embedded alongside it, 183 bytes and invisible at that size, doing the job those pixels usually do: confirming the message was opened, in which mailbox, and when. The only other links in the body were benign, a corporate site belonging to the vendor's parent group and one unrelated e-commerce domain that reads as a signature artifact. Every genuinely inspectable destination was clean.

The subdomain that wore the vendor's name

The anchor behind the image resolved to uniontransit[.]chaugiangdalat[.]com, and the visual snapshot of that page shows a document-download portal.

Read that hostname from the right and the attack falls apart immediately. The registrable domain has nothing to do with logistics, with file sharing, or with the vendor, and per registration records it was created the same day this email was sent, privacy-protected and served by Cloudflare nameservers. The vendor's name is only the leftmost label, a position anyone can fill with any word they like on a domain they control.

Nobody reads hostnames from the right. Readers scan left to right, meet a familiar name first, and stop, which is why label placement stays one of the highest-yield tricks available for the cost of one DNS record. This is acquired infrastructure, MITRE ATT&CK T1583/001, paired with the delivery pattern in T1566/002, Spearphishing Link. And at the moment of delivery no reputation service had any history for that domain, because there was none to have.

See Your Risk: Calculate how many threats your SEG is missing

What the link token was carrying

The path after that hostname ran 324 characters of base64-looking text, and it was not padding. Decoded, it is a structured tracking payload: send and message identifiers, click identifiers, and a secondary destination pointing at hxxps://www[.]tonerpartner[.]si/dchaneemail. It also carried recipient-identifying fields, which are not reproduced here.

Two consequences follow. First, each recipient very likely received a distinct URL, so approaches built around a shared malicious link have less to aggregate, and every mailbox that clicks is individually attributable. Second, the operator was measuring. Identifiers for the send, the message, and the click mean this was instrumented like a marketing campaign, which is how sustained fraud against a known vendor relationship gets run. The click itself is T1204/001, User Execution: Malicious Link.

Authentication that told the truth and still helped

SPF passed. The message left Microsoft 365 outbound protection from 2a01:111:f403:c207::3, a source legitimately permitted for the vendor's domain, and traversed normal Microsoft inbound hops into the recipient tenant. DKIM was mixed across the ARC chain, with one hop recording a pass for the vendor domain and the final hop recording no signature at all. DMARC came back as bestguesspass with action=none, and composite authentication returned compauth=pass reason=109.

That DMARC result deserves a translation, because it is not a pass. No usable policy was found for the sending domain, so a pass was inferred from the surrounding signals. RFC 7489 describes DMARC as an alignment and reporting mechanism for the From domain, and a domain that publishes nothing gives it nothing to align against. A best guess is being consumed downstream as a verified result.

The more important field is quieter. The platform's first-time-sender flag was false, meaning prior correspondence already existed between this address and the manufacturer. This is the shape of vendor email compromise: whether the vendor mailbox was compromised or its identity was spoofed, the trust the controls extended was accurate. The relationship was real. Only the author had changed.

Six weeks of the same vendor contact

A recipient in customer services reported the message, and the incident was closed by a manual analyst decision rather than by an automated verdict. One detail in the raw body is worth recording without explaining away: the tenant's own first-contact banner had been injected in Italian, warning that this was the first time an email had been received from this sender, while the structured first-time-sender field said the opposite. Two views of the same relationship disagreed inside one message.

The sequence is the actual finding. The same sender pattern came back against additional coworkers two days later, again shortly after that, and once more roughly six weeks on with a different pretext, a fake account statement rather than a shared file. Later instances were quarantined. No confidence figure was recorded for the first message, but the trajectory is the useful part: a per-message verdict cannot see a widening target list under one vendor identity, whereas Themis correlates across messages, mailboxes, and tenants, with the people receiving the mail reporting into the same loop.

What a single image actually removed

Nothing in this attack was technically broken. The sender was real and permitted, the history was real, the parent-group links were real, and the only fabricated components were one picture and one day-old domain.

What the image removed was the text layer, where most inspection and nearly all human judgment happen. What the same-day domain removed was reputation history. Between them, a defender is left comparing what a message claims to be against every hostname it actually uses, read from the right, which is why credential-harvesting protection has to evaluate the rendered destination and the sending relationship together rather than scoring words. Credentials stay the objective because they still work: the 2024 Verizon Data Breach Investigations Report put stolen credentials in 38% of breaches, the most common initial action, and measured a median of 28 seconds from click to data submission. CISA's phishing guidance argues for putting the control ahead of the click, and NIST is blunt that the technique targets the person, not the protocol.

Indicators of Compromise

MITRE ATT&CK Mapping