An Attachment Named Like the Microsoft 365 Admin Center

An engineering operations director inside the overseas product-engineering division of a large automotive manufacturer opened his mailbox to a familiar sight: a Microsoft 365 subscription-renewal notice, apparently from a colleague, with a single attachment waiting for review. The attachment was named to look like the Microsoft 365 Admin Center, and the director's own email address was stitched into the filename. Nothing about the attachment list looked out of place at a glance. Everything about the message headers, once you read them, was wrong.

This is a case where the attacker declined the obvious move. They never tried to forge Microsoft's sending domain or stand up a convincing lookalike. Instead, they hijacked a real company's mail identity, borrowed Microsoft's own outbound relay, and let a cleverly named file carry the brand impersonation the headers could not.

The authentication story the headers told

The visible From-domain failed SPF. The sending IP sat well outside the authorized range for the domain the message claimed to come from, so the SPF check returned a hard fail. DMARC failed too, but only in the sense that alignment did not hold. The claimed domain published a DMARC record set to p=none, meaning it requested no enforcement action at all. A failing DMARC evaluation with a p=none policy is a check that reports a problem and then asks the receiver to do nothing about it.

DKIM is where the trick lived. The message did carry a valid DKIM signature, so a shallow inspection that keyed on "DKIM: pass" would have waved it through. The signature validated for an unrelated Microsoft-hosted tenant subdomain, one ending in onmicrosoft[.]com, that had no relationship to the visible From-domain. The cryptography was sound. The identity was not. Microsoft's composite authentication, compauth, returned a borderline reason code in the 110s range, the score band that signals partial alignment rather than a genuine pass. Every individual gate produced a technically defensible answer, and the sum of those answers was a phishing email in an executive's inbox.

Whose infrastructure was this, anyway

The From address belonged to salib[.]asia, a real domain registered more than a decade before this attack to a Hong Kong insurance brokerage. This was not a throwaway domain minted the week before to fool a domain-age heuristic. It was an aged, legitimately owned property, which is precisely what makes it useful. Long registration history reads as trustworthy to reputation systems that reward tenure.

The relay hop tells a similar story. The message passed through a legitimate Microsoft 365 outbound tenant that the brokerage did not own, which points to either a second compromised M365 tenant in the chain or a business-email-compromise relay stitched together from more than one hijacked account. The use of valid accounts to move mail is catalogued in MITRE ATT&CK as T1078, and it is the quiet backbone of this entire attack. The infrastructure was borrowed, not built, which is why so little of it lit up as malicious on its own.

Why the filename was the payload

The attachment carried no macro and no embedded executable. It was an HTML file, and its entire deceptive weight rode on two design choices. First, the filename mimicked the Microsoft 365 Admin Center, so an admin skimming the attachment row saw a phrase they associate with legitimate tenant management. Second, the recipient's own email address was baked into the filename, a personalization and mailbox-validation trick that makes the file feel provisioned specifically for that person.

Opening the HTML did not open any admin console. It rendered a local fake Microsoft sign-in page whose only job was to capture the credentials typed into it. Because the deception rendered from a file on disk rather than a link fetched over the wire, there was no URL for a gateway to pre-scan at delivery time and no reputation lookup to fail. MITRE tracks this attachment-borne delivery as T1566.001, and the brand-string-in-a-name technique as masquerading, T1036.005. A brand name in a filename is a static trust cue. It is not scanned, it is read, and it was read by a human under time pressure exactly as intended.

The tell that simple gating missed

The reliable signal here was never any single authentication verdict. It was the disagreement among them. The visible From-domain, the domain that actually passed DKIM, and the relay identity should all point at the same organization. In this message they pointed at three different places, and DKIM passing for a domain unrelated to the sender is the sharpest tell of the set. A pass-or-fail gate cannot see that mismatch because, locally, DKIM did pass. Cross-referencing identity across the headers is where our Adaptive AI does its work, weighing domain-identity consistency as a behavioral signal rather than trusting any one gate in isolation. That is also why a borderline compauth score and a p=none policy, each individually shruggable, add up to a clear anomaly when read together.

The renewal-notice pretext and the compromised-tenant relay are a two-part pattern worth naming. The lure is business email compromise wearing a Microsoft costume, and the delivery mechanism is a foothold in a legitimate mailbox, the same foothold that makes account takeover so hard to unwind once credentials are harvested. The 2024 Verizon Data Breach Investigations Report puts stolen credentials in 38% of breaches as the top initial action, and phishing present in 15% of breaches, with the human element a component of 68%. When the payload is a filename an executive reads in seconds, those numbers stop being abstract.

Indicators of compromise

MITRE ATT&CK mapping

The attachment failed SPF, failed DMARC, and still nearly worked, because the brand impersonation was never in the headers where the checks were looking. Read the identities together, not one at a time, and the disagreement is impossible to miss.

See You Next Time

Every attack of the day is a real case pulled from the field and stripped of anything that could identify the target. Come back tomorrow for the next one.