A Summons Stamped 2018 That Ends at a OneDrive Login

The date stamp on the "court order" said 2018. The email arrived in 2026.

That eight-year gap is the cleanest tell in a South African phishing kit that did almost everything else right. A one-page PDF titled "Summons" landed in the shared admin mailbox of a South African financial services firm. It cited a "default court order," demanded compliance over "remittance due to your creditors," and warned of execution proceedings against the recipient's assets.

The email body held no lure text at all, only the recipient gateway's first-contact banner and the sending company's own legal disclaimer. Everything the attacker wanted to say lived in the attachment.

Borrowed authority, tuned to one country

The PDF was a Word-authored single page. Its imagery was the point.

It carried a Republic of South Africa Special Tribunal seal beside the tribunal's statutory mandate to recover public funds lost to corruption and fraud. It showed a red "APPROVED" stamp. It had a scrawled signature over a caption for an Assistant Master of the Western Cape High Court, plus a red rubber stamp reading "Master of the Western Cape High Court" with an Afrikaans line underneath ("Meester van die Wes-Kaap Hoe Hof").

A South African reader would recognize every element. That is what the localization buys the attacker: a bilingual stamp and a real state agency's mandate read as local knowledge, and local knowledge reads as authenticity.

It is neither. Seals and stamps are images, and images copy. Nothing in the record suggests the Special Tribunal or the High Court had any part in this message. The authorities were impersonated, and the signature block did not resolve to a named official.

The stray apostrophe in "The above subject bear's reference" was a second tell, though a weaker one. Grammar errors are fading as a signal. A stamp dated October 2018 on a document dated September 2026 is not fading.

One button, one pull zone

The PDF held exactly one live element, a link annotation behind a button labelled "VIEW COURT SUMMONS HERE." The platform found no JavaScript, no launch actions, no embedded files and no auto-actions in the file. The attachment verdict was clean, which fits a document whose only active content is a link.

The button opened a page on BunnyCDN, a legitimate content delivery network. The attacker had registered a pull zone whose subdomain was the pretext itself: "hicourtsummons."

On a shared apex such as b-cdn[.]net, that label is free text. Anyone can pick it, and it costs nothing to make it say "court." The reputation belongs to the apex. The wording belongs to the attacker. Defenders should block the specific subdomain, not the CDN.

The summons was never the payload

The page behind the button was not a court document. It was a OneDrive-styled modal reading "Sign in with Microsoft Email to open One Drive," with email and password fields and a Next button.

Behind the modal sat a blurred "Shared with you" view. Its quick-access entries were South African B-BBEE compliance files, the local broad-based black economic empowerment paperwork that a South African finance team would find routine. The decoy added one more layer of regional plausibility to a page whose only job was to collect a password.

No POST target appears in the record, so where a submitted password would go is not established. No victim click or submission was recorded either.

The mismatch is the lesson. A default judgment is served through formal legal channels. It is not opened by signing in to a cloud storage account. The moment a legal document asks for a Microsoft credential, the document has told you what it is.

Mapping the chain

Delivery is a spearphishing attachment (T1566.001). The attacker depends on user execution of the link (T1204.001), hosts the page on a CDN account they control (T1583.006), and harvests input through a spoofed login form (T1056.003).

The message was sent from inside a real South African company's own Microsoft 365 tenant, an IT-admin-style mailbox at a small professional-services firm with no connection to courts or finance. That is consistent with a hijacked account (T1586.002), which would also explain why it authenticated cleanly at the origin. It is not proven, and the sending company is a bystander.

The recipient's own gateway added a first-contact banner and delivered it. That is a reminder of how little a first-time sender with a clean attachment gives a rules-based filter to work with. The platform scanned the landing page too and also returned clean.

Credentials sit at the center of the 2026 Verizon Data Breach Investigations Report: 39% of breaches involve credentials across the full kill chain, and phishing is the initial access vector in 16%. The report also finds the human element in 62% of breaches. A forged summons is an efficient way to reach that human element, because it manufactures urgency before the reader has time to check the stamp. For background, see the FBI IC3 2024 report, CISA phishing guidance, the Microsoft Digital Defense Report 2024 and the NIST definition of phishing.

See Your Risk: Calculate how many threats your SEG is missing

A secure email gateway (SEG) judges reputation and structure. This message offered neither a bad sender nor a bad file. What it offered was a pretext, a stamp and a destination, and only the last of those was wrong.

Where detection actually landed

The incident was resolved automatically as phishing and the message was quarantined. Automated detection reported it, with no human analyst verdict recorded in the data used here. The Themis agent did not supply a confidence figure in the current record, so none is claimed.

For defenders, the practical rules are short:

1. Treat any legal or government document that asks for a cloud sign-in as credential harvesting, whatever the seal says. Our credential harvesting glossary entry covers the pattern.
2. Check dates on stamps and signatures. Lifted images carry their original dates.
3. Block attacker-named CDN subdomains individually, and keep the shared apex reachable.
4. Teach finance and admin teams that localized detail, such as real agency names, bilingual stamps and local compliance terms, proves nothing about authenticity.

Detection that reads the message's intent, rather than the sender's reputation, is what catches this class. IRONSCALES credential harvesting protection is built for that gap.