A Carrier's Own DKIM Signed a Bank Credential Phish

Everything a header check can prove about this message was proven. SPF passed. DKIM passed. DMARC passed. Microsoft's composite authentication returned a pass with reason 100, the strongest verdict available at the front door.

None of it belonged to Crédit Agricole, the French bank whose branding filled the body.

The passes belonged to a European logistics carrier, a real freight business with no plausible connection to retail banking. Its domain signed the message, its envelope domain took the bounces, and its DNS records made all four checks succeed. The carrier is a second victim here, not the attacker.

The Difference Between Borrowed and Hijacked

There is a familiar pattern where an attacker slips through SPF because a domain publishes a broad shared hosting include:, so any mailbox on that host inherits a pass. That is not what happened here, and the two fail differently.

This was not a passive quirk. The carrier had configured full domain authentication with its email service provider: a dedicated em-prefixed subdomain of its own domain carrying the envelope mail-from, and a DKIM selector signing with the carrier's own domain as the signing identity. That is the setup a domain owner completes deliberately, by publishing CNAME records, precisely so that its mail aligns and its DMARC policy is satisfied.

The attacker did not find a hole in it. The attacker got inside it, and inherited the whole channel: reputable provider IP space, a valid signature over an aligned domain, and a bounce path that behaves exactly like the carrier's genuine mail. Whether the entry point was a stolen provider API key or the DNS and account itself, the record cannot say. What the record does say is that content with nothing to do with freight went out through freight infrastructure that authenticated correctly.

That distinction matters at triage. Misalignment leaves a contradiction in the header and analysts are trained to find it. There was no contradiction here. The only mismatch was between the domain that authenticated and the brand in the sender alias, which read as the bank's account-access service. No authentication mechanism evaluates that relationship, and RFC 9989 does not ask it to. Domain alignment is a question about domains.

The Platform Argued With Itself

One detail is the closest thing to a free signal here. While composite authentication returned its strongest pass, the same platform's spam heuristics scored the message at confidence level five and stamped it as spam in the antispam report.

Both verdicts shipped on the same message, from the same vendor, at the same moment. One measured provenance, the other read content and behavior. When they disagree, the content score carries the new information, because provenance has already been satisfied by whoever controls the sending domain.

The Landing Domain Was Hours Old

The single call to action, labelled in French as a request to renew a trusted device, routed through the provider's own click-tracking hostname before resolving to an attacker-registered domain built to look like a customer-details update page.

That domain was created roughly four hours and a quarter before the message was sent, on the same calendar day. Not the day before. Four hours. Its registrant fields were entirely privacy-shielded, it was unsigned for DNSSEC, and its nameservers sat with a low-profile hosting operator.

Four hours is a deliberate number. Domain age is a signal most tooling measures in days, so a reputation lookup on a four-hour-old host returns nothing known bad, because nothing has had time to know it. This is T1566.002, Spearphishing Link, executed on infrastructure that had not existed long enough to acquire a history, with the bank costume mapping to T1656, Impersonation and the click itself to T1204.001, User Execution: Malicious Link.

See Your Risk: Calculate how many threats your SEG is missing

Wrapped, Timed, and Padded With Invisible Characters

The payload link was not naked. It was wrapped in the provider's click-tracking service, the same rewriting legitimate customers enable to count clicks, so the hostname a hovering recipient sees belongs to a major transactional provider rather than anything hostile. A one-pixel open beacon on the same account rode along with it.

The pressure came from a fabricated European payment-regulation compliance pretext: devices not renewed would be blocked as of a stated date roughly a day after the message went out. Close enough to feel urgent, far enough to seem procedural.

The subject line was padded with invisible zero-width characters inserted mid-word, plus a trailing word joiner. It renders normally to a human and breaks naive string matching on the exact subject, a low-cost way to defeat rules written against a known campaign. The bounce path carried a per-recipient encoded token, and the unsubscribe header was mailto-only with no companion one-click header, failing the RFC 8058 standard that genuine bulk mail at this volume follows.

What Detection Actually Had to Work With

Remove authentication from the evidence pool and the list is short: a first-time sender for the organization at a high sender risk level, a brand in the alias that had nothing to do with the domain doing the signing, a wrapped link to a host with no history, and a deadline.

That is what got it. Themis flagged the call-to-action link as malicious and scored the message at 88% confidence with a credential theft label, supported by a community-reputation signal drawn from similar reports resolved elsewhere. The incident was automatically resolved as phishing and mitigated for the single affected mailbox. Signals of that kind are what Adaptive AI reads when the header block has stopped being informative.

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access vectors and credentials in 39% of breaches across the full kill chain, which is why a credential harvesting page on a four-hour-old domain is worth more to an attacker than any malware attachment.

Practical Controls for Authenticated Impersonation

Compare the authenticated domain against the brand asserted in the display name as a first-class check, and alert when a consumer-facing financial brand appears over an unrelated commercial domain. Nothing in SPF, DKIM, or DMARC performs that comparison.

Score domain age in hours, not days. A creation timestamp inside the same calendar day as the message is a strong standalone indicator, and it is cheap to look up at delivery time.

Treat a passing composite authentication result and a high spam confidence level on the same message as a contradiction worth escalating rather than a net neutral.

Resolve provider click-tracking wrappers to their terminal destination and judge that. The CISA phishing guidance makes the same case for layered, behavior-aware controls, and the NIST definition of phishing is about deceiving a reader, which no DNS record can attest to.

Indicators of Compromise

The Bottom Line

This message reads as trustworthy because its authentication is not forged, borrowed, or misaligned. It is real, and it belongs to a freight company that did its DNS homework correctly. Take over a properly configured sending channel and every provenance control returns the answer the domain owner earned. The gap left is the one no protocol covers: the brand a human reads has never been the domain a machine verified.