The Vendor Spoof With No DKIM at All

A contract-signing lure landed in the inbox of the president of a specialty food distribution company, and it wore the name of a national food distributor, the kind of 25-year-old vendor that thousands of restaurants order from every week. The pretext was ordinary: Action Required, sign the contract. What makes the case worth a closer look is how little the attacker bothered to do to earn that trust. Not one authentication check passed. There was not even a DKIM signature to fail, because the message was never signed in the first place.

Most brand-impersonation attempts at least try to look authentic at the transport layer. This one did not. It bet everything on a familiar vendor name and an urgent verb, and that bet reached a VIP mailbox anyway.

The Spoof That Did Not Try

The From header used the distributor's genuine domain, a name registered back in 1998. But the message never touched any of that vendor's mail infrastructure. It originated from 51.89.54[.]13, a generic cloud hosting IP in Germany whose reverse DNS resolves to ip13.ip-51-89-54[.]eu, and it was actually routed through an unrelated throwaway domain, 2b77c4eef[.]info.

The authentication verdict was unambiguous. SPF returned softfail, because that German IP is not authorized to send for the distributor's domain. DKIM was absent entirely. DMARC failed. Microsoft's composite authentication logged compauth=none with reason=404. Every mechanism that exists to prove a sender is who it claims to be either failed outright or was never present, and the email still reached the recipient the attacker most wanted: the person with authority to sign a contract.

That is the uncomfortable part. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC are inputs to a delivery decision, not a universal hard gate. When the wrapping infrastructure carries some reputation and no analyst-grade layer is reading intent, a message that fails every server-level check can still cross the threshold.

A Kit Held Together With Tape

The body itself gave away its origins. It was a garbled, multi-brand-stuffed template with fragments of unrelated content bleeding through the seams: Agilent product links and Korean-language kit artifacts that had no business appearing in a food-distribution contract notice. That mess is the signature of a recycled or rented phishing kit, reused across campaigns and never fully cleaned between runs.

For a defender, the sloppiness is a gift and a warning at once. A gift, because the leftover artifacts are a loud tell that the message is templated fraud. A warning, because the operator did not need a clean build to succeed. The kit only had to render a plausible Sign Contract button, and the rest of the deception rode on the spoofed brand and the recipient's habit of trusting a vendor name.

Microsoft SafeLinks, Turned Into a Delivery Vehicle

The single call to action was wrapped in a Microsoft SafeLinks URL. SafeLinks is the Defender for Office 365 feature that rewrites links so they can be re-checked at click time, and its presence in a message reads as a reassuring sign that the mail passed through a Microsoft-protected tenant. Here it did the opposite of reassure. The wrapper decoded to a form hosted on forms.monday[.]com, the legitimate work-management platform.

Rather than register a lookalike domain and stand up its own credential page, the attacker pointed the lure at a real monday.com form and let it serve as the contract-signing and credential harvesting trap. The destination inherited monday.com's reputation and a valid TLS certificate, so a link-reputation check had nothing obvious to flag. Abusing trusted software as a service this way is now standard tradecraft: the Microsoft Digital Defense Report 2024 documents the same shift toward riding legitimate services instead of breaking them.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft maps cleanly to a few techniques in the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery: a socially engineered contract lure whose payload is a wrapped link to a hosted form.
• T1585.002 Establish Accounts: Email Accounts covers the throwaway sending domain and cloud host stood up to spray the kit.
• T1204.001 User Execution: Malicious Link covers the final step, where the recipient clicks through to the monday.com form.

Indicators of Compromise

What Actually Catches This

Signature and reputation tooling was never going to be the hero here. The final destination sits on a legitimate SaaS platform, the link arrived pre-wrapped by Microsoft, and there is no attachment or malware to fingerprint. The signals that matter are relational: a header From on a real vendor's domain that carries no SPF, DKIM, or DMARC support, a body stuffed with brand fragments that do not belong together, and a trusted-brand button that resolves to a generic form rather than that brand's own site.

That is the gap augmenting Microsoft 365 with behavioral analysis is built to close. Themis, the Adaptive AI analyst on the IRONSCALES platform, weighs the claimed brand against the actual sending path, the kit tells in the body, and the mismatch between the vendor name and the form it points to, the way a trained analyst would, and flags the impersonation even when every server-level verdict has already fired or, as here, failed. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches, and the FBI's 2023 Internet Crime Report ranks business-identity and vendor impersonation among the costliest fraud categories reported that year. This case pulled exactly that lever, aimed at exactly the right person.

The Takeaway

A recognizable vendor name is a trust shortcut, and this attacker spent every other resource betting that the shortcut alone would work. It nearly did. The defense is to stop treating a familiar brand in the From field as proof of anything and to verify the path: authentication results, the true sending host, and where a button actually lands before anyone clicks. When a contract you did not expect asks you to sign through a link, the safe move is to confirm it through a channel you already trust, not the one that arrived unannounced. CISA's guidance on recognizing and stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one