The Foxit eSign Email That Erased Foxit

The most important line in this email was one the recipient never saw: table {display:none !important}.

It sat inside a genuine Foxit eSign notification, sent through Foxit's own infrastructure. Foxit's envelope (the logo, the "sent you a document to review and sign" line, the orange View Document button, the DO NOT SHARE THIS EMAIL footer) is built entirely from HTML tables. The stylesheet told the mail client to hide every table, every row, every cell, and the button container for good measure.

What was left was a Binance security alert. It was built without a single table, so it survived the rule that erased everything around it.

Two messages in one body

Most abuse of trusted SaaS notifications works by addition. The attacker's text rides along next to the platform's copy, and a careful reader can still see the seams.

This one worked by subtraction. The platform's interface was not outshouted. It was deleted.

The attacker's half of the body gives the game away in its own comments. The HTML includes Header / Logo (was table-based) and the CSS includes Employee details "table" replacement. Someone took a table-based template, rebuilt it from div.page, div.container, div.card and a .details-grid set to display:grid, and did it specifically so the content would outlive a global table kill rule. That is not an accident of formatting. It is a design decision.

In clients that honour the embedded stylesheet, the reader sees a Binance card titled "Phone Number Updated." The Foxit envelope that actually carried it is invisible. (Classic Outlook desktop and some webmail sanitisers may strip or ignore a body-level style block, so the effect will not be universal.)

How the attacker got custom HTML into a Foxit-signed notification is not established. What is established is that the attacker operated a Foxit eSign account named "Binance" and set a Reply-To of a free Gmail mailbox.

The rendered alert and its one ask

The visible card claimed the account's phone number had been changed to a masked number with a +971 prefix on "Sun, Jan 25th at 11:59AM GMT+4." It then raised the stakes: "This new phone number will now have authority over two-factor authentication, support tickets and concierge correspondence."

The call to action was a phone number, not a link. "Didn't request this? Please contact our security team at +1 800-344-4914 (Toll Free) to cancel this request." Footer links in the attacker block pointed to #. They went nowhere.

This is telephone-oriented attack delivery (TOAD), mapped to MITRE ATT&CK T1566 Phishing with the voice sub-technique (T1566.004) as the follow-through, and to T1564 Hide Artifacts for the CSS that concealed the carrier. The 2026 Verizon Data Breach Investigations Report puts callback and TOAD lures at 5% of the email gateway attack mix (Fig. 54). Small share. Hard to catch, because there is nothing to click and nothing to detonate. The FBI IC3 2024 report shows how much money still moves through impersonation that ends on a phone call, and NIST's definition of phishing never required a link in the first place.

The incident grouped two subjects across four mailboxes at a US investment firm on 2026-01-25: "Your Phone Number Has Been Changed" and "Your Contact Preferences Have Been Updated." One recipient held a Director title. Only the phone-number variant's body was retrieved for analysis.

Why the gateway had nothing to object to

One paragraph on authentication, because it matters as context and not as the lesson.

The message was submitted to SendGrid over its HTTP API and arrived at Microsoft EOP in a single external hop from Foxit's outbound host. SPF, DKIM (d=foxitsign.com) and DMARC all passed, with compauth=pass. EOP scored it SCL 1, non-spam, and delivered it to the inbox. The only two links were Foxit's own click tracker, both clean. No attachment, no QR code. For a reputation and URL engine, there was nothing here.

That is the decoupling the CSS creates. Every header says foxitsign.com. Every pixel says Binance. Neither the header view nor the rendered view, on its own, tells you the two disagree.

See Your Risk: Calculate how many threats your SEG is missing

A secure email gateway (SEG) or a native M365 filter evaluates the envelope it can verify. It does not ask whether the brand a human will see matches the platform that signed the mail. IRONSCALES flagged the message as a first-time sender with Credential Theft and VIP Recipient labels from Themis, the agentic AI analyst, all four copies were quarantined, and a human analyst resolved the incident as malicious.

Reading the source, not the screen

Note what is not an IOC. Foxit, SendGrid, Binance and Microsoft are all bystanders here. Blocking foxitsign.com would break legitimate signing workflows and do nothing about the next platform.

The durable indicator is structural. A legitimate SaaS notification has no reason to hide its own tables. A global display:none on table, tr and td inside a vendor template is an anomaly worth a rule on its own, regardless of what renders after it.

What to change on Monday

Compare the signing domain to the rendered brand. When an authenticated e-signature notification renders as a crypto exchange, a bank or a payroll provider, that mismatch is the signal. It only shows up if someone, or something, looks at both the headers and the raw HTML.

Treat phone numbers as payloads. A message whose only call to action is a toll-free number deserves the same scrutiny as one with a link. CISA's phishing guidance tells users to verify through a known channel; train that explicitly for account-change alerts. A primer on vishing helps frame it for non-technical staff.

Give reporters a fast path. The 2026 DBIR attributes 62% of breaches to the human element. Behavioral context counts here too: IRONSCALES platform data draws on 36,000+ security professionals across 18,000+ organizations, which is how a first-time sender with a VIP recipient gets the second look a reputation score never would.

Stop judging a notification by how it looks. In this case, how it looked was the attack.