A Same-Day Domain, a Fake Law Firm, a Real Google Share

The share notification that reached a large engineering and infrastructure consulting firm was not a forgery. It came from Google's own Drive notification address, carried two valid Google DKIM signatures, left Google's own outbound relay, and entered the tenant's Microsoft 365 mail flow through standard front-end transport with a perfect composite authentication score. Every technical assertion the message made about its origin was true.

What the message asserted about its author was not. The sender display name carried the name of a major international law firm followed by a debt-related suffix and the "(via Google Drive)" tag Google appends to share notices. The shared item was titled to read as collection correspondence with a demand to pay that day. And the address that would have received any reply sat on a domain that had been registered the same calendar day the message was sent.

Two clocks were running in this email. One belonged to a law firm with decades of reputation and to a cloud provider trusted by nearly every mail filter in the world. The other belonged to infrastructure that was hours old.

The letters were not the letters

The subject line rendered as a shared-item notice about collection correspondence arriving with a demand for immediate payment. Typed in Latin characters, that phrasing would trip a brand-impersonation rule or a debt-scam keyword list without much trouble. It did not, because most of the vowels were not Latin.

The actual string was closer to Cоllеctiоn Cоrrеspоndеncе Аrrivеd, where the letters reading as o, e, and A are Cyrillic small o (U+043E), Cyrillic small e (U+0435), and Cyrillic capital A (U+0410). The demand to pay carried Cyrillic small a (U+0430) in both words. The display name was built the same way, with Cyrillic substitutions inside the firm's name, a section sign standing in for the ampersand, and a modifier letter dropped into the debt suffix so even that word would not tokenize normally.

This is masquerading in its cheapest and most durable form. A person reads glyphs; a filter compares code points. The firm's name never appears in the message as a matchable string, so no impersonation rule keyed to that brand can fire, and no keyword list built on English debt-collection vocabulary sees anything to score.

Google really did send it

The authentication picture was flawless, and that is the point rather than a footnote. SPF passed against Google's Drive bounce domain. DKIM passed twice, once for Google's primary signing domain and once for its infrastructure domain. DMARC passed. Composite authentication returned the maximum score, so the receiving tenant treated the message as fully vouched-for mail from an authorized sender.

None of those results were wrong. The attacker created a share on Google Drive and let Google's notification pipeline do the delivery, which means the sending domain genuinely sent the mail. RFC 7489 is explicit about the boundary of what that proves: alignment between a signing domain and a visible identity, nothing about whether the identity claimed inside the body is honest. When the transmitting party is a global cloud provider and the impersonation lives entirely in a display name and a Reply-To header, authentication has no opinion to offer.

The payload followed the same logic. The message carried one destination, repeated as an "Open" button and as the file-name link, pointing at a real file-view page on Google's own Drive domain. Link reputation scanning returned a clean verdict, correctly. There was no attacker-hosted page to fingerprint and no redirect chain to unwind.

See Your Risk: Calculate how many threats your SEG is missing

The reply path was younger than the message

The one piece of attacker-controlled infrastructure in the entire message was the Reply-To address, on a subdomain of safeportalcheck[.]com. A WHOIS lookup during triage put the registration on the same calendar day as the send, through a low-cost registrar, with nameservers on a large CDN and no public reputation history of any kind.

That timing is the tell. Reputation systems need history, and there was none to have. Blocklists need a prior observation, and this domain had never been observed. The address existed for one purpose: to catch a reply from anyone who read the shared item, believed a law firm was pursuing a debt, and answered. Acquiring purpose-built domain infrastructure immediately before use is standard operating procedure precisely because it defeats every control that depends on the past.

It also explains why the file share mattered less than it looked. The attacker did not need a credential page. A reply, carrying a name, a role, a phone number, and a willingness to discuss payment, is the asset. Reply-diversion fraud of this shape drove the roughly $2.9 billion in losses reported in the FBI Internet Crime Report, and it needs no malware to work.

A broadcast wearing the clothes of correspondence

The recipient list gave the campaign away to anyone who read it. The To and Cc fields held more than twenty unrelated addresses across construction, logistics, local government, small business, and personal webmail accounts, with a single mailbox at the consulting firm among them. No law firm sends collection correspondence to a mixed public distribution list.

Worth stating plainly, because the tradecraft can look more targeted than it is. This was a low-effort blast that borrowed a trusted delivery channel and a recognizable brand, then let volume do the rest. It needs one recipient anywhere on that list to answer, and the 2024 Verizon Data Breach Investigations Report measured the median time to click a phishing link at 21 seconds, with the human element present in 68% of breaches.

What actually caught it

The message was classified and automatically resolved as phishing on content and sender analysis rather than on any link or reputation hit, affecting a single mailbox. There was nothing for a reputation engine to catch, so the verdict had to come from the composition of the message: non-Latin characters substituted into a recognizable brand name, a Reply-To domain with an age measured in hours, and the structural contradiction of a cloud-provider notification that routes replies to unrelated external infrastructure.

Those are relational judgments rather than lookups, which is the kind of reasoning our Adaptive AI applies alongside header checks instead of after them. It is also the gap that opens when a tenant treats authentication results as a trust signal, which is why Microsoft 365 augmentation has to evaluate identity claims the mail flow already blessed. CISA phishing guidance makes the same argument from the defender's side: plan for the lure to arrive intact and to be believable.

Indicators of Compromise

Disposition: full SPF, DKIM, DMARC, and composite authentication pass; automatically resolved as phishing on content and sender signals. Payload: single link to a legitimate cloud file share. One mailbox affected.

MITRE ATT&CK mapping

• T1036 (Masquerading): Cyrillic look-alike characters substituted into the impersonated firm's name and throughout the subject line so rendered text and parsed text diverge.
• T1566.002 (Phishing: Spearphishing Link): the entire payload is one shared-file link, delivered inside a genuine cloud notification.
• T1583.001 (Acquire Infrastructure: Domains): the Reply-To domain was registered the same day it was used, leaving no history for reputation or blocklist controls to act on.
• T1204.001 (User Execution: Malicious Link): the scam depends on the recipient opening the shared item and then replying to the attacker-controlled address.

See you next time

The uncomfortable part of this case is that almost every control gave the right answer. Google really sent the mail. The signatures really validated. The link really did resolve to a legitimate file host. The only two facts that mattered were that some of the letters came from the wrong alphabet and that the reply address belonged to a domain younger than the email carrying it. When the sending path is borrowed and clean, check the character set and check the clock.