The Phish That Forgot to Delete Its Old Footer

The subject line read like a benefits system doing its job: the employer's full legal name, the word "invited", then the employee's name. Underneath, a headline announcing a salary increase, one line saying the company had invited the employee to review the details, and one button: "Visit Portal".

The mailbox belonged to an accounts-receivable specialist at a national staffing and recruiting firm, a shrewd place to aim a payroll lure. A staffing company runs payroll for thousands of placed workers, so its people expect compensation paperwork from systems they did not choose.

The sender is where it stopped making sense. The display name was an all-capitals shout, "HUMAN RESOURCE / PAYROLL", followed by a bracketed pair: the recipient's own name, a colon, and a long alphanumeric token. That is a mail-merge variable that never merged, a per-recipient identifier the attacker meant to consume quietly and printed in the From line instead.

The address beneath it belonged to a generic info@ mailbox at a decades-old British medical practice, a domain registered for more than twenty years with nothing to do with staffing or payroll.

A Payroll Notice From a Medical Practice

There was no business relationship to find, and hunting for one is the mistake this case is built to punish. Not a vendor, not a client, not a corporate cousin.

What the practice did have was a properly configured bulk-mail setup: a dedicated subdomain delegated to a large email service provider, that provider's mail exchangers and sending authorization in DNS, and a click-tracking host on its own label. A competent marketing configuration, the kind a small business stands up once and forgets for years. It was also, that day, the delivery channel for a credential-harvesting lure.

Every Authentication Check Failed, and It Arrived Anyway

Read the final Authentication-Results line and this looks like the easiest block of the week. SPF softfailed. DKIM failed outright, the receiver reporting no key for the signature it found. DMARC failed with an action of override-reject: the practice's own published policy asks receivers to reject mail that fails, and this mail failed. Composite authentication came back as none.

It reached a person's inbox regardless.

The contradiction starts one hop earlier. The message crossed a security gateway that attested the chain it had received, and that attestation recorded a very different picture: envelope sender authorized, DMARC passing under the reject policy, and DKIM invalid rather than forged, its signature pointing at a selector never published for that subdomain. One hop said pass. The next said fail. Which a receiver acts on is a local decision, and the record shows the outcome, not the reasoning.

The anomaly needs no invented mechanism: a message that failed its sending domain's own enforced reject policy reached a mailbox anyway. That is the practical limit of DMARC as specified in RFC 7489, a policy the owner publishes and a receiver decides what to do with. The inconsistency traces to that subdomain's incomplete signing setup rather than a clean forgery, and the envelope bounce address confirmed the plumbing was genuine: the provider's standard bounce format on the practice's own sending subdomain, with the recipient's mailbox and employer domain encoded into its local part.

See Your Risk: Calculate how many threats your SEG is missing

The Footer Nobody Was Supposed to See

Below the portal button, the HTML carried a block styled to disappear: white text, one percent opacity, a single-pixel line height and maximum height. In a mail client it is a hairline of nothing. Extracted as text it runs several hundred words.

Hiding bulk text shifts a message's statistical balance, burying a short malicious ask inside innocuous prose so scoring engines find most of it unremarkable. That is T1027, obfuscated information, applied to an email body rather than a binary. What made this block extraordinary, though, was what the attacker had chosen to hide, or more precisely had never bothered to delete: a complete forwarded marketing message from the sending account's genuine past. A podcast sponsorship pitch, written by the practice's own marketing lead, addressed to a contact at an unrelated European insurance business, sent months earlier. Signature block intact. Sender title intact. At the bottom, a live one-click unsubscribe link of the kind a legitimate bulk sender must include.

Nobody proofreads a region set to one percent opacity. So the phishing message shipped with its predecessor still inside it, and that predecessor was real marketing mail to a real prospect.

That artifact settles what the authentication headers only gestured at. This lure was not built on fresh, disposable infrastructure. It was composed inside an aged, legitimate marketing account, on a template already used for its real purpose. That is compromised email accounts as a delivery strategy rather than domain registration: the attacker inherited a warm sending reputation, a delegated subdomain, working bounce handling and a click tracker, all free. The practice is a bystander, and treating a decades-old medical domain as hostile infrastructure punishes the one party with no say.

Two Links, Both Rewritten

Both calls to action, the portal button and the hidden footer's unsubscribe link, came back wrapped by the recipient's own URL-rewriting gateway, each carrying an opaque token and a query parameter naming the practice's click-tracking host.

Two things follow. The rewriter belongs to the recipient's security stack, not the attacker's, worth remembering whenever a rewritten link turns up in an indicator list. And it confirms both links were live in the delivered message, so the invisible layer shipped as part of the body, not inert in an attachment.

The ask was ordinary T1566.002 spearphishing via link: a portal, a login form, and whatever the operator does with the credentials. The 2024 Verizon Data Breach Investigations Report puts stolen credentials in 38% of breaches as the leading initial action and the median time from opening a phishing message to clicking its link at 21 seconds. Twenty-one seconds is why credential harvesting protection cannot rest on someone noticing that a payroll invitation came from a doctor's office.

What Closed It

Our Adaptive AI scored the message at 89% confidence, and it is worth being precise about that number. All three contributing signal families, content patterns, community reporting and sender analysis, matched bulk-mail characteristics rather than a phishing determination. It was confident the message was unwanted, not that it was credential theft.

That gap is where impersonation lives (T1656). A hijacked marketing account sending marketing-shaped HTML with a real unsubscribe footer looks like bulk mail to a classifier, because except in intent, it is. The case closed on human judgment: a colleague reported it and a reviewer approved the verdict by hand, because someone knew what the firm's payroll notices look like. No automated mitigation is recorded against the affected mailbox. The machine narrowed it and a person called it, and CISA's guidance on stopping the phishing attack cycle treats that kind of verification outside the message as the control that survives a convincing lure.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Friday

The tell was not in the headers. Contradictory headers are ordinary in mail that crosses a gateway. It was a paragraph the attacker could not see and never edited, naming the sending account's real owner, purpose and history.

So when a message hides a block of text, extract all of it. The visible copy is what somebody wrote on purpose. The invisible part is what they forgot, and forgotten things are where provenance survives. Here it turned a suspicious sender into a confirmed victim.