Every Auth Check Passed. The Payload Was One Header.

A message with the subject Request for Quotation! arrived in a customer service mailbox at a North American business that fields inbound quotation requests. Four lines, no attachment, and not one of the links in the delivered copy had been placed there by the attacker.

That removes most of an email security stack from the conversation. No landing page to sandbox, no attachment to detonate, no URL to rewrite, no domain to block.

The header block, meanwhile, was immaculate. SPF pass. Two DKIM signatures, both verified. DMARC pass. Microsoft's composite authentication returning a pass with reason code 100. A valid ARC chain. None of it was forged. The message really was composed inside a legitimate Microsoft 365 tenant belonging to a regional government health service, by someone operating an authenticated session to a mailbox that was not theirs.

The entire attack was one header field.

The Weapon Was the Reply Path

Reply-To carried a sales alias on a medical supply themed domain with no relationship to the authenticated sending organization. Registration ran through a mass market registrar on a single year term, DNS sat behind a large content delivery provider, and every registrant contact field was privacy shielded. It was not a same day burner either: the domain had been registered roughly eight months before the message was sent, long enough to clear the reputation heuristics that treat fresh domains as inherently suspect. Age was part of the setup.

Set that against the rest of the identity set. The header From aligned with the sending domain, Return-Path aligned with the header From, and the two DKIM signatures aligned with the sending domain and its Microsoft tenant domain. Reply-To was the only unaligned identifier anywhere in the message, and it is the one field the authentication layer has no opinion about. DMARC aligns the From domain against a validated SPF or DKIM identifier. Reply-To sits outside that scope, so it can point anywhere without moving the result.

Four Lines and a Thread That Never Existed

The body was a short follow up, quoted here in full apart from the greeting and sign off: "I am following up to confirm that you've received the quotation I sent on Monday. Kindly confirm receipt. If you did not receive it, please let me know and I will promptly resend it."

No signature block. No company name. No personalization. And no earlier message: the header set contains no In-Reply-To and no References, while Thread-Topic mirrors the subject. The quotation supposedly sent on Monday has no thread behind it in the message's own metadata.

Notice what is being asked for. Not a payment, not credentials, not a click. Just confirmation of receipt. The reply itself is the conversion event, which is why MITRE files this behavior under phishing for information rather than under any technique involving a payload. It is also the most reply provoking pretext available against a mailbox whose job is answering inbound quote requests. Being helpful is the vulnerability.

Two Signatures and an Enforced Policy

Most authenticated phishing passes under a permissive DMARC policy. This one did not. The ARC authentication results record the published policy as quarantine, subdomain policy quarantine, at 100 percent coverage. The pass was earned against enforcement.

Both DKIM signatures verified against the same body hash: one under the organization's own domain and selector, one under its Microsoft tenant domain. The Received chain then explains where the message was born. It contains an internal MAPI submission from one tenant mailbox server to itself, the fingerprint of a message handed to the service by an authenticated client rather than injected by an external host, alongside a Thread-Index consistent with an Outlook send. From there it left through the organization's own outbound email security gateway, whose address is legitimately listed in the domain's SPF record.

Signed on the Way Out, Not at the Desk

One more field settles provenance. Alongside the final authentication results sits the evaluation taken while the message was still inside the originating tenant, before egress processing. It reads dkim=none (message not signed) and dmarc=none.

The message was therefore unsigned at composition, and the signatures were applied on the way out by the sending organization's own infrastructure. Nothing outside that tenant can reproduce that sequence. This was not domain spoofing, not a lookalike, not a shared relay abusing an SPF include. It was account takeover, and every green result in the header block is the sending organization's controls working as designed on behalf of whoever held the session. To be precise about the evidence: the record proves an authenticated mailbox session and nothing more, not how that session was obtained.

Addressed to Someone Else Entirely

The From and To addresses are identical, both the compromised mailbox. The actual recipient appears in neither, so delivery was by blind copy, and the person who opened it was reading mail visibly addressed to a stranger. That hides the distribution, and it removes any legitimate correspondent who might have noticed the redirected reply path.

The receiving tenant, to its credit, did flag the message, surfacing a first contact notice and an external sender caution bar. Both were injected by the recipient's own platform rather than by the attacker, as were the three Microsoft support links in the delivered copy. Two user facing warnings, and it still needed a detection engine to resolve it.

See Your Risk: Calculate how many threats your SEG is missing

Nothing Wrong With the Sender to Find

Adaptive AI scored the message at 90 percent confidence and the case was automatically resolved as phishing within seconds of arrival, with no human reporter involved. The recorded reasoning combined content pattern analysis with two community reputation signals drawn from how similar incidents resolved elsewhere.

The detail that matters most is an empty field. The sender analysis insight list came back with nothing in it, because there was nothing wrong with the sender to find. A domain in good standing, correct records, valid signatures, an authorized gateway. The case was carried entirely by relational signals: a first time sender, no prior correspondence in either direction, a high sender risk score, a recipient absent from both From and To, and one misaligned reply address.

Microsoft's content filtering, incidentally, disagreed with Microsoft's own authentication verdict, drawing a spam confidence level of 5, a spam category classification, the safety classification reserved for phishing, and delivery to Junk. Two verdicts inside one platform pointed opposite ways, and the one most humans read is the header block.

Three Changes Worth Making

The 2024 Verizon Data Breach Investigations Report puts the human element in 68% of breaches and pretexting, mostly business email compromise, at the top of the social engineering category, with a median transaction around $50,000. The 2023 FBI IC3 report puts reported BEC losses near $2.9 billion. Messages like this are how those numbers get made, without one blockable indicator in the delivery path.

Three practices follow. Score the reply path as an identity in its own right, independently of the DMARC result, since a misaligned Reply-To on an otherwise aligned message is deliberate configuration rather than accident. Treat zero payload mail as a category to be analyzed rather than as an absence of evidence. And treat authenticated mail from a partner mailbox as capable of hostility, verifying requests through a channel that does not run back through that mailbox. As CISA's phishing guidance and the NIST definition of phishing both frame it, the test is deception and objective, neither of which authentication measures.

Indicators of Compromise

MITRE ATT&CK Mapping