Two Images, Zero Text: A Secure-Document Lure

Four employees inside a hospital system's senior-care and social-work department opened the same email on the same morning. It looked like a routine notification from a home health-care agency they might plausibly coordinate with. A secure document was waiting, a single button invited them to preview it, and there was almost nothing else to read. That was not an accident: the entire pitch lived inside two images.

That is the whole trick, and it is a good one.

A message with no scannable body text hands a keyword filter nothing to grade. No misspelled urgency, no obvious credential-harvest phrasing, no readable link, because none of it is text. It is pixels. One image displayed the agency's branding and a warm tenure claim, "Celebrating 15 Years of Excellent Service, family owned and operated." The second image carried the actual hook: "You have got a secure document," followed by a preview-document call to action. To a person skimming an inbox, it reads as a vendor sharing a file. To a text-based scanner, it barely reads at all.

The sender was talking to itself

The From address used a real, established home health-care agency's own domain, registered years earlier and belonging to a genuine family-owned business. That is what made the branding image land. But the message was self-addressed: the From and To fields were the same agency mailbox. An external notification that claims to come from an agency, yet is addressed from that agency to that same agency, is a classic spoofing tell. Legitimate secure-document notifications do not arrive addressed to the sender who supposedly created them.

This is the same identity abuse that underpins business email compromise: the attacker is not breaking a technical control, they are borrowing a trusted identity so the recipient's guard drops before a single link is clicked.

Authentication that passed at one hop and broke at the next

The most instructive part of this case is where the authentication verdict changed.

At an intermediate outbound gateway hop, SPF passed for the envelope sender. A naive single-hop check that trusted that early pass would have waved the message through. But authentication is re-evaluated as mail moves, and by final inspection the story was different. SPF failed, because the final sending IP was not authorized for the agency's domain. DKIM failed, because the signature did not verify at all: it had been signed by an unrelated onmicrosoft.com tenant that had nothing to do with the sender's own domain. DMARC failed as the downstream consequence, and the compound authentication result came back as none.

A broken signing chain across relays is not the same thing as a clean pass-through. The pass that appeared early was a snapshot from one point in the journey, not a guarantee about the message as delivered. Any control that stops checking after the first green light inherits the attacker's preferred version of events.

See what a single-hop gateway lets through: calculate your email security gap.

A destination that scanned clean

The single call to action wrapped a link to a legitimate document and notes SaaS platform, app.recall[.]it, which defeats reputation scanning by design. The platform is genuinely real and widely used, so a URL-reputation check clears the domain without hesitation. The attacker was not hiding behind a freshly registered throwaway, they were renting credibility from a service the recipient's tooling already trusts.

The abuse lived on the landing page, not in the domain. The captured landing snapshot showed an urgent file-download prompt, a "get your files here" push framed to move the reader from curiosity to click before they slowed down. The email opens the loop with a vague secure-document promise, and the trusted-looking destination closes it with pressure. Because the destination itself is a legitimate hosting layer, a scanner that only rates domain reputation sees nothing to stop.

Why this one needed to be read, not just checked

Every server-level lever an attacker usually trips was inconsistent or absent, and the content that would normally give a filter something to grade had been turned into images. That combination is where behavioral analysis earns its keep.

Themis, the Adaptive AI analyst on the IRONSCALES platform, does not stop at the auth verdict or the domain reputation. It ran optical character recognition over the two images to recover the secure-document lure and the branding claim, and it analyzed the link's landing page rather than just its domain. Reading the OCR'd content alongside the download-prompt destination, it flagged the message as credential theft and an image-based attack at 86 percent confidence, a call drawn from patterns seen across 35,000+ security professionals at 17,000+ organizations. All four targeted mailboxes were pulled before anyone clicked through.

The broader shape of the risk is familiar. The 2024 Verizon Data Breach Investigations Report puts phishing in 15 percent of breaches and the human element in 68 percent, and it clocks the median time to click a phishing link at 21 seconds. An image-only lure is engineered for exactly that reflex window: nothing to read slowly, one obvious button, and a spoofed-but-familiar sender name that only shortens the pause.

The takeaway

An early authentication pass is a claim about one hop, not a verdict on the message. When the text is hidden inside images, the sender is talking to itself, and the auth result flips between the gateway and the inbox, the honest signals are the ones a scanner has to work for: what the pictures actually say, whether the sending identity holds up end to end, and what waits behind the only button in the email. Read those, and a polished secure-document notification stops being convincing.

CISA's guidance on recognizing and stopping phishing early is a useful reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one

Indicators of Compromise

MITRE ATT&CK Mapping

The tradecraft lines up with a few techniques in the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the core delivery: a socially engineered message whose payload is a single wrapped link to a cloud-hosted page.
• T1204.001 User Execution: Malicious Link covers the preview-document click the whole lure depends on.
• T1036.005 Masquerading: Match Legitimate Name or Location covers the branded image and the spoofed agency identity, both used to manufacture legitimacy.

See You Next Friday

Trusted names and clean-looking notifications get easier to fake every week. The defense is to read what the machine reads, and to keep reading past the first green light.