When Four Security Wrappers Launder One Phishing Click

The message that reached four mailboxes at a global engineering and environmental consulting firm looked like a routine banking notification. It carried a major bank's branding, addressed a real employee by name, referenced account details that lined up, and asked for one small thing: click REVIEW DOCUMENT to sign off on a flagged remittance and payment adjustment. There was no attachment. There was no invoice. The entire attack lived inside a single link, and that link had been engineered to survive inspection by borrowing the reputations of the very tools built to stop it.

Authentication was never the problem

The mail was sent through Amazon SES, a legitimate bulk-sending service, from the domain 5000art[.]com. That domain has nothing to do with the impersonated bank or with the target firm, but on paper the message checked out. SPF passed on the SES sending IP. DKIM verified against both the sending domain's signature and the amazonses[.]com signature. DMARC returned a best-guess pass, composite authentication passed, and Microsoft assigned a spam confidence level of just 1.

This is the recurring lesson of modern phishing, and the 2024 Verizon Data Breach Investigations Report frames the stakes plainly: phishing is present in 15 percent of breaches, and the median time for a user to click a phishing link is 21 seconds, with data submission following just seven seconds later. Authentication confirms that a server was authorized to send a message. It says nothing about whether the sender is who they claim to be, or whether the link inside leads somewhere safe. A brand-unrelated domain sending through a reputable ESP will authenticate perfectly, which is exactly why attackers reach for services like SES.

The click that passed four checkpoints

The interesting part was the button. When our analysts decoded the REVIEW DOCUMENT link, it did not point at a single destination. It pointed at a stack of them, one nested inside the next like a set of forwarding addresses:

Indicators of Compromise

Read that top to bottom and the trick becomes obvious. The click first entered a bank-styled notification wrapper. That handed off to a Cisco Secure Web address. Cisco's proxy passed the click to a Trend Micro click-time redirector. Trend Micro forwarded to a Barracuda link-protect wrapper. Barracuda passed it to an Edgepilot hop. Only after all five layers did the browser finally arrive at the true destination: a small Brazilian business website, registered to a private individual since the early 2010s, that had been quietly compromised rather than stood up by the attacker.

Each of those middle wrappers is a real security product doing exactly what it was designed to do. And that is the point. A link-rewriting proxy trusts the domain that hands work to it. When a scanner inspects Hop 2, it sees a Cisco domain and clears it. When it inspects Hop 3, it sees Trend Micro and clears it. Every individual reputation check in the chain looked at a recognized vendor URL and waved it through. The attacker never had to defeat any single control. They only had to stack enough of them that no one control could see the whole path.

Why the score never fired

Here is what makes this case unusual. There was no automated confidence score for this message at all. It slipped past the machine-scoring layer entirely, because every signal that layer normally leans on came back clean: authenticated sender, recognized-vendor link domains, no attachment, no obvious payload. A reputation-and-authentication gate had nothing to flag.

The tell was never in any one field. It was in the aggregate: a message wearing a bank's brand, sent from an unrelated art-supply domain, carrying a link that laundered itself through four separate vendors before resolving to a hacked small business with no connection to the impersonated bank. That is a masquerading pattern (MITRE T1566.002, spearphishing link, feeding T1204.001, user execution of a malicious link, dressed in T1036 brand impersonation), and it only becomes visible when you correlate signals that individually mean nothing. This is precisely the gap our Adaptive AI platform is built to close: instead of trusting a wrapper domain's reputation, it evaluates sender-to-brand relationships and the decoded destination as one picture, and it feeds analyst findings back into the model so the next chained attack does not get a free pass.

What defenders should take from this

The uncomfortable truth is that a security vendor's rewrite domain is not a safety guarantee, and that gap between what a gateway checks and what actually reaches the inbox is worth measuring for your own environment (our email security gap calculator is one way to size it). Attackers have learned to treat those wrappers as free reputation, nesting legitimate proxies to bury an unrelated final destination. CISA's phishing guidance stresses breaking the attack cycle at multiple points rather than relying on a single gate, and this case is the reason why.

Three practices matter. First, decode the entire link chain, not just the first hop or the last, and treat an unrelated final domain as a red flag no matter how reputable the intermediate hops look. Second, weight brand-versus-sender mismatch heavily, because a bank notification arriving from an unrelated ESP domain is an identity problem authentication will never catch. Third, remember that payment and remittance pretexts are among the costliest, a reality reflected in IRONSCALES business email compromise protection, which focuses on the intent behind a message rather than the cleanliness of its headers. The wrappers did their jobs. The attacker just used four of them at once.