Microsoft-Signed Mail Carried This Payment Phish

The email that landed in a company's accounts-payable inbox passed SPF, DKIM, and DMARC. It was signed by microsoft.com under a reject policy. It was, by every measure a gateway checks, cryptographically legitimate Microsoft mail. And it was a payment-fraud lure.

This is the case that should end the argument that authenticated mail is safe mail. The sender showed as "EFT-Account Payable" from surveys[@]email[.]formspro[.]microsoft[.]com, a first-time sender to this organization. It did not spoof Microsoft. It came from inside Microsoft's own marketing pipeline.

Real Microsoft authentication, real payment fraud

The message transited Microsoft Dynamics 365 Customer Voice, the survey and feedback product formerly branded Forms Pro. The envelope path ran through Microsoft-operated hosts (mail13[.]mailip[.]dyn365cv[.]com, nam[.]pb-dynmktg[.]com), which is exactly why the authentication came back clean.

SPF passed. DKIM passed with a signature of d=email[.]formspro[.]microsoft[.]com. DMARC passed with header.from=microsoft.com under p=REJECT. Those are not forged results. Microsoft genuinely signed and sent this mail, almost certainly because an attacker abused a self-serve Customer Voice or Forms Pro account to push a "survey" that was really an invoice lure.

That is the trap. A defender scanning the headers sees a Fortune-scale sender with perfect alignment and a strict DMARC policy, and concludes the message is trustworthy. Authentication answered the question "who signed this envelope?" It never touched the question that mattered: "where does the button go?"

Where the Review Payment buttons actually led

The body carried two "Review Payment" calls to action. Both resolved to the same place, and it was not Microsoft.

The CTAs led to a Railway platform-as-a-service subdomain, hxxps://lifesgreat111-production-67877[.]up[.]railway[.]app/, which presented a human-verification slider gate before revealing any content. That gate is not a decoration. It is a scanner filter. Automated URL sandboxes and gateway crawlers will not solve an interactive challenge, so they see a benign verification page and pass the link. Only a live human clicker gets forwarded to the payload. It is user execution by design, and it maps cleanly to T1204.001, User Execution: Malicious Link in MITRE ATT&CK.

Chained into that flow was a freshly registered redirector domain, debodowhy[.]xyz, which appeared in the CTA chain to move victims onward. To make the whole thing feel routine, the attacker interspersed genuinely benign links: real ShareFile references, a real Microsoft Customer Voice unsubscribe footer. Those legitimate elements are camouflage. They raise the trust score of a message whose only dangerous components are the two payment buttons.

This is T1608, Stage Capabilities: the attacker staged delivery on a trusted SaaS marketing platform and staged the payload on commodity PaaS hosting, borrowing reputation at both ends. The initial email is T1566.002, Spearphishing Link.

Indicators of Compromise

Note what is not in that table. The redirector bounced toward some benign third-party sites during analysis. Those are not attacker infrastructure and defenders should not treat them as indicators. The only sender line here is abused legitimate Microsoft mail, and blocking microsoft.com would break your business while doing nothing to stop the next abuse of the same pipeline.

The signals the gateway threw away

Every mechanism a secure email gateway (SEG) relies on graded this message as clean. Authentication passed. The sending domain was Microsoft. The visible links included real Microsoft and ShareFile URLs. A reputation-and-authentication model has nothing left to flag.

Our Adaptive AI, Themis, read the same message differently and scored it 88 percent malicious with the label "Invoice Phishing." It did not care that Microsoft signed the envelope. It weighed the combination that actually defined the attack: a first-time sender to this tenant, an "EFT-Account Payable" display name paired with payment urgency, and a CTA destination that did not match the trusted infrastructure it claimed to originate from.

That destination mismatch is the whole game. This is textbook business email compromise, where the money moves not through malware but through a plausible instruction to review or redirect a payment. The 2024 Verizon Data Breach Investigations Report puts the median BEC transaction near 50,000 dollars and names pretexting, largely BEC, as the top social-engineering incident type. The same report clocks the median time to click a phishing link at 21 seconds. A human-verification gate is engineered to keep a machine from ever reaching the payload, so a fast human click is often the first and only interaction with the malicious content.

See Your Risk: Calculate how many threats your SEG is missing

The pattern is not fringe. Microsoft's own Digital Defense Report 2024 documents attackers steadily shifting toward abuse of legitimate cloud and SaaS services precisely because that traffic inherits trust. CISA's guidance on stopping the phishing attack cycle makes the same structural point: authentication controls reduce spoofing, but they cannot vouch for the intent behind mail that is genuinely signed.

Across 35,000+ security professionals and 17,000+ organizations, IRONSCALES platform data shows this failure mode repeating: authenticated, trusted-vendor mail carrying malicious destinations. That is why augmenting Microsoft 365 with detection that reads behavior and intent matters more as attackers move onto the platforms your controls already trust.

Stop reading authentication as a safety verdict

Treat SPF, DKIM, and DMARC as identity checks, not safety checks. They tell you who signed the envelope. They tell you nothing about who wrote the body or where the button leads. Inspect CTA destinations independently of sender reputation, weight first-time-sender and payment-urgency signals even when the domain is Microsoft, and require out-of-band confirmation for any change to payment instructions. When the mail is cryptographically perfect and the button still lands on a Railway slider gate, the button is the attack.