The Grant Thread Was Real. The Portal Was Not.

The quoted thread at the bottom of this message was not a forgery, and that is the whole problem.

Everything beneath the attacker's new top paragraph was authentic correspondence: a genuine federal grant notification, addressed to the organization that genuinely holds that award, carrying a real grant number, program office, and program name. The header and footer images were hotlinked directly from the web server of GrantSolutions, the multi-agency federal grants system that sent the original notice. Nothing in the quoted content fails inspection, because nothing in the quoted content is fake.

What was fabricated was the paragraph on top, and the identity of the person reading it.

A Real Thread Delivered to Someone Who Was Never On It

The original notification had two addressees, both mailboxes belonging to a small community-development nonprofit and a related nonprofit domain. The message in our record went to an operations executive at a professional services firm with no relationship to that grant or either nonprofit.

The visible recipient field read as undisclosed recipients. The actual delivery address appeared only in Bcc. That is the shape of a mass send, not a forward, and it sits badly next to quoted content specific enough to name one organization's grant record.

The sender was the nonprofit's own Google Workspace mailbox, under a staff member's name in the sender alias. The platform recorded a first-time sender at a high risk level with no prior correspondence in any direction, neither to the recipient nor to the recipient's organization. A real mailbox, a real thread, and zero relationship history is the combination MITRE ATT&CK describes as compromising email accounts rather than registering new infrastructure, and it is why nothing about the sending domain looked young. That domain had been registered for roughly three and a half years, with a mainstream registrar and no delinquency flags.

The new top paragraph claimed the grant submission portal was attached, and offered a single link labelled as files and project documents. Underneath it, the real thread carried on doing its work.

The Authentication Posture Is Unremarkable

It would be easy to oversell the header block here.

The sending domain published no SPF record at all, so the receiving side recorded a result of none. DKIM passed, but the signature belonged to Google Workspace's delegated signing domain, a gappssmtp[.]com subdomain derived from the nonprofit's own domain name, which does not align with the visible sender domain. With no SPF to fall back on and no aligned signature, DMARC failed. The published policy was none, so receivers were asked to take no action on that failure, and none was taken.

ARC sealed and passed at the second instance, the ordinary artifact of a message relayed between Google-hosted mailboxes, not tampering.

Read plainly, this is what a small nonprofit's mail looks like, not a clever bypass. A missing SPF record and a policy of none are a configuration gap shared by a very large number of organizations, and RFC 9989 can only enforce what a domain owner asks for. Delivery here was not won by defeating authentication. It was won by not needing to.

What the Screenshot Confirmed, and What It Did Not

The single call to action pointed at a marketing redirect URL on public-usa[.]mkt[.]dynamics[.]com, Microsoft's own Dynamics 365 marketing link service. The platform's static link verdict on that URL was clean.

A live screenshot of that same link shows a page branded as a PNC Foundation grant funding opportunity, displaying an assigned opportunity number and gating everything past that point behind one field asking for a work or business email, with a continue button.

That much is observed: an email-harvesting gate, captured live. What is not observed is what happens after the field is filled. No interactive traversal past that page was performed, so whether a password or any further data is requested is not established by this record. The credential framing comes from the platform's own read of the message, which scored it at 82% confidence with a credential theft label. Keeping those two things separate matters, because credential harvesting is the likely destination of an email gate on a fake funding portal, and likely is not the same word as confirmed.

See Your Risk: Calculate how many threats your SEG is missing

Why the Scanner Returned Clean

The redirect hostname belongs to Microsoft and carries marketing links for the entire Dynamics 365 customer base. A reputation lookup returns a large, legitimate SaaS platform, the honest answer to the question a static check asks, and unblockable for the same reason.

Everything after the hostname is an organization identifier and an opaque redirect token: no readable destination, no lookalike spelling, no fresh registration date, nothing for a pattern to catch. This is T1566.002, Spearphishing Link with the payload parked one hop behind a name no reputation system will ever downgrade.

What Detection Actually Had to Work With

Take authentication off the table, because it was ordinary, and URL reputation with it, because it said clean. There was no attachment at all.

What remained was behavioral. A first-time sender at a high risk level. No correspondence history in either direction. A recipient list hidden behind undisclosed recipients while the body quoted one organization's specific grant record, from a thread whose original addressees did not include the reader. A financial brand in the lure with no connection to the domain that sent the mail.

That is the evidence Adaptive AI is reading when the header block has stopped being informative. Themis scored the message at 82% confidence for credential theft and the incident was automatically resolved as phishing for the single affected mailbox, with no human mailbox action recorded.

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access vectors and newly tracks pretexting as another 6%, and this message is both at once: a link to click, wrapped in a pretext borrowed wholesale from real correspondence. The FBI's 2025 Internet Crime Report attributes just over $3.05 billion in reported losses to business email compromise, a category built on borrowed credibility.

Controls for Reused Legitimate Threads

Compare the addressees named inside a quoted thread against the current envelope. When the reader is absent from the correspondence they are shown, the forward is not a forward.

Treat undisclosed recipients plus highly specific quoted content as a contradiction rather than two mild signals. Genuine mail about one reference number goes to named parties.

Weight relationship history above domain reputation. A well-aged domain plus a mailbox that has never spoken to your organization is describing account takeover, not trust, and the CISA phishing guidance makes the same case for behavior-aware controls.

Resolve marketing and CRM redirect wrappers to a terminal page and judge the page, not the wrapper. The NIST definition of phishing is about deceiving a reader, and no reputation score on a Microsoft hostname speaks to that.

Indicators of Compromise

The Bottom Line

Most thread-hijack lures are reconstructions. Someone stitches a plausible reply chain out of scraped details, and the stitching is where the tells live: a reference that does not resolve, a logo at the wrong resolution, a signature block from the wrong year. This one had no stitching. The attacker did not build a credible thread, they took delivery of one, then addressed it to a stranger and appended a link. Inspect the quoted content all you like and it will keep passing, because the only fabricated things are the top paragraph and the recipient.