A Free Trial Bought Them a Perfect Sending Identity

The notification was exactly what it claimed to be. A mechanical contracting firm had shared files. The mail came from a well-known enterprise file-sharing platform, issued by that platform's own notification infrastructure, and every authentication check agreed. SPF passed. DKIM passed. DMARC passed. Microsoft's composite authentication returned a perfect score of 100.

The recipient, a payroll manager at a regional automotive dealership group, had never received anything from this sender before. That was the first loose thread. The second was buried in the headers: the Reply-To pointed at a burner mailbox on an anonymous mail service with no connection to the contracting firm, the platform, or anybody in the recipient's supply chain.

Nothing about the message was forged. That is the whole problem.

The Sending Identity Was Rented, Not Forged

Most fully authenticated phishing starts with a compromised mailbox. This one did not. The attacker signed up for the file-sharing platform's trial tier, named their tenant after a real mechanical contracting firm, uploaded a file, and clicked share. The platform then did what it is built to do: it generated a share notification and sent it from its own notification domain, filecloudmail[.]com, through a commercial email service provider relay.

Follow the authentication chain and every link is legitimate. SPF passed because the relay IP was authorized to send for the envelope domain. DKIM passed with a signature from the notification domain itself. DMARC passed with the From header aligned to that same signing domain, exactly as RFC 7489 specifies. The HELO greeting announced the trial tenant host, a subdomain of the platform's own trial-provisioning domain.

There was no lookalike domain to score, no misalignment to flag, no reputation gap to notice. The attacker did not build sending infrastructure; they borrowed a vendor's, and the vendor handed it over as part of a free signup flow. The sender alias carried the contracting firm's full company name, so the inbox showed a business the recipient could plausibly owe money to, vouched for by a green authentication result. Impersonation without forgery, run by an operator who never touched a DNS record.

Where the Replies Were Actually Going

The single discordant field in the entire message was Reply-To. It resolved to a mailbox on atomicmail[.]io, an anonymous mail provider of the kind used specifically because it requires no identity to obtain and leaves nothing to subpoena.

That one field converts an authenticated notification into a live conversation channel. The recipient sees the contracting firm, replies to ask about the shared file, and the reply never reaches that firm at all. It lands with the attacker, who now holds a warm thread with a payroll contact who believes they are talking to a vendor. That is the standard opening move of business email compromise, and it needs no malware to pay off.

The economics justify the effort. The 2023 FBI IC3 Internet Crime Report put reported BEC losses at roughly $2.9 billion, and the 2024 Verizon Data Breach Investigations Report identified pretexting, mostly BEC, as the leading social engineering pattern, with a median transaction near $50,000.

See Your Risk: Calculate how many threats your SEG is missing

A Plain-HTTP Link From an Enterprise Platform

The body offered a share link, and the version rendered for the recipient used plain HTTP rather than HTTPS. A second link in the same message, a deep link into the portal's file browser, did use HTTPS, so this was not an all-cleartext message. It was a downgrade on the path the recipient was most likely to click.

That mismatch matters twice. An unencrypted request carrying a share token is exposed in transit, and a mature enterprise product does not casually serve its primary call to action over plain HTTP, so the downgrade is a cheap, high-signal anomaly even when the domain is clean.

The shared object was an HTML file, which through a trusted portal is a credential-harvesting surface: it renders a convincing sign-in page on a domain the recipient trusts, with none of the scanning a document or archive would attract. Textbook spearphishing link tradecraft, wrapped in legitimate hosting.

Why a Trial Tier Is Free Attacker Infrastructure

Strip the case down and the attacker's shopping list was one email address and a signup form.

They skipped domain registration, DNS configuration, DKIM key publication, and the slow work of warming a new sender so it stops looking new. Every one of those steps is a place defenders get a signal, and a trial tenant on a reputable platform erases all of them at once. The Microsoft Digital Defense Report describes the broader shift: attackers increasingly work through legitimate services and valid accounts rather than infrastructure of their own, because the trusted path is cheaper and quieter than a hostile one.

Detection therefore had to come from behavior. This was a first-time sender to the recipient. The Reply-To domain had no relationship to the From domain. The primary link was protocol-downgraded. The request matched nothing in the recipient's history with that supposed vendor. Themis, the Adaptive AI analyst in the IRONSCALES platform, scored the message at moderate confidence, 50 percent, drawing on community insight from how similar incidents had been resolved elsewhere rather than on the authentication result. An analyst confirmed the verdict on manual review and the message was quarantined.

Moderate confidence is worth sitting with. Authenticated mail from real vendor infrastructure rarely produces a screaming signal, which is why escalation to a human is a load-bearing part of the control.

Indicators of Compromise

Values are defanged. The trial tenant slug was the impersonated firm's company name run together without spaces, so the host is masked below. The durable indicators are the platform's notification and trial-provisioning domains, the anonymous reply mailbox, and the relay IP.

Mapping the Attack to MITRE ATT&CK

Three techniques carry this case. Delivery is Spearphishing Link (T1566.002). The infrastructure step is Cloud Accounts (T1585.003), where the operator provisions accounts on legitimate cloud services instead of standing up their own. The social layer is Impersonation (T1656), borrowing a trusted business relationship so the request reads as routine.

Closing the Trial-Tier Gap

You cannot blocklist a reputable file-sharing platform, and you should not try. What you can do is stop treating a passing authentication result as the end of the inquiry. Practical steps for security teams:

• Score Reply-To against From, always. Alignment between the two is not an authentication requirement, which is exactly why attackers exploit the gap. A Reply-To on an unrelated anonymous or disposable provider, behind a fully authenticated corporate From address, is one of the highest-yield single signals available.
• Flag protocol downgrades on SaaS links. An enterprise platform serving its primary call to action over plain HTTP is anomalous enough to score, independent of the domain's reputation.
• Treat first-time senders as first-time senders, no matter how clean. Authentication says the domain is real. It says nothing about whether this correspondent has ever spoken to this recipient.
• Verify vendor file shares out of band. The CISA phishing guidance for network defenders is plain about it: confirm through a contact you already hold, never by replying. Replying is the outcome this attack was built to produce.

The uncomfortable part is how little this cost to build. No compromised mailbox, no lookalike domain, no malware. A free trial on somebody else's reputable platform, a tenant named after a real company, and one header field pointed somewhere it should not go. Authentication was never going to catch that, because nothing about it was inauthentic.