A Fake Attorney, Your Real SSN, and a $697 Demand

The most alarming part of this email was not the legal threat or the payment demand. It was that the message reproduced the recipient's real Social Security number, date of birth, and mailing address, right there in the body, as if a genuine legal file had landed in their inbox.

It had not. The whole thing was an extortion scam built to convert breached personal data into a fast $697 payment, and it reached an employee at a tribal government organization wearing enough real detail to feel legitimate.

One Transposed Letter

The sender did not spoof anyone's domain. They bought their own. Six days before the blast went out, someone registered a domain through Squarespace Domains that transposed two letters in the name of a real, well-known federal criminal-defense practice. The genuine firm's address and the fraudulent one differ by a single character, the kind of swap that sails past a glance and only surfaces if you read the address letter by letter.

That six-day-old domain became the entire trust anchor for the attack. The message claimed to come from a named former senior U.S. Department of Justice trial attorney, a real person whose identity was lifted wholesale for the fraud. To reinforce the story, the email even included a link to the attorney's genuine biography page on the real firm's website. Every credibility prop pointed at something real. Only the sending and reply infrastructure belonged to the attacker.

Authentication That Proved Ownership, Not Trust

Here is the part that should bother any defender leaning on email authentication as a verdict. This message passed DMARC.

The blast was relayed through SendGrid, a legitimate email platform. SPF failed, because the SendGrid relay IP was not authorized for the sending sub-domain the way the record was written. Normally that is where a naive filter relaxes: SPF failed, move on. But Domain-based Message Authentication, Reporting and Conformance (DMARC) passes when either SPF or DKIM aligns to the header From, and the attacker had signed the message with a valid DKIM key on their own lookalike domain. DKIM passed. Alignment held. DMARC returned a pass with action=none, and Microsoft's composite authentication logged compauth=pass reason=100.

Read that again. The authentication stack confirmed, correctly, that the message was cryptographically signed by the domain that sent it. That domain just happened to be a six-day-old fraud registered to impersonate a law firm. Authentication verified ownership. It said nothing about trust. When an attacker controls their own domain, they can satisfy every server-level check in the book, because those checks were designed to answer "did this domain send this?" and not "should you believe it?"

The Money and the Off-Domain Reply

The lure demanded an immediate $697 payment via Apple Pay, card, or PayPal, framed as the way to make described legal and financial consequences disappear. The payment call to action and the Reply-To both routed through SendGrid click-tracking on subdomains of the lookalike domain, so any click or reply landed on attacker infrastructure rather than anything connected to the real firm. A tracking asset hosted on a bare IP address confirmed when a recipient opened the message, giving the operator a live-target signal for follow-up pressure.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft lines up cleanly against the MITRE ATT&CK framework:

• T1566.002 Spearphishing Link covers the payment and reply calls to action, both wrapped in SendGrid click-tracking on the attacker's domain.
• T1204.001 User Execution: Malicious Link covers the intended victim action, following the payment link under manufactured urgency.
• T1657 Financial Theft covers the objective, a direct extortion payment driven by fabricated legal jeopardy.

Indicators of Compromise

Detection and What to Watch For

Every server-level signal that a legacy gateway trusts came back green here, which is exactly why signature and reputation checks were never going to catch it. Detection has to read intent and relationship. The signals that matter are a header From on a domain registered days earlier, a display identity claiming a well-known professional while the actual domain is unrelated and brand new, a DMARC pass riding on a DKIM signature from that same throwaway domain, and reply and payment paths that lead off-domain into ESP click-tracking.

This is where IRONSCALES adds a layer the static stack misses. Themis, the Adaptive AI analyst on the IRONSCALES platform, weighs domain age, the gap between a claimed identity and the actual sending domain, and the off-domain reply and payment routing the way a trained analyst would, flagging the impersonation even when authentication is technically clean. Across 35,000+ security professionals and 17,000+ organizations, that relationship-aware view is what separates "this domain signed the mail" from "you should trust this mail." The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and names pretexting, the social-engineering family this belongs to, as the top incident type, while the Microsoft Digital Defense Report 2024 documents the same pivot toward abusing legitimate services rather than breaking them. The FBI's 2023 Internet Crime Report likewise ranks extortion and personal-data misuse among the most reported crime categories, which is precisely the lever this campaign pulled.

The Takeaway

Breached personal data is now a phishing prop. When an email can recite your Social Security number and birthdate, the reflex is to believe the sender must be official, and that reflex is exactly what the $697 demand was engineered to trigger. The defense is to treat authentication as a fact about ownership, not a verdict on trust, and to confirm any legal or financial demand through a channel you already trust rather than a link in the message. Real attorneys and real agencies do not collect settlements through Apple Pay links on a domain registered last week. Pairing that habit with behavioral detection is what closes the gap against impersonation and business email compromise, because the next scam armed with someone's real data is already being addressed. CISA's guidance on recognizing and stopping phishing early is a solid team reference: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one