The Payroll Change That Authenticated Perfectly

The subject line was DIR.DEPOSIT. Eleven characters, no verb, the kind of shorthand a busy colleague types when they are already thinking about the next task. Below it sat three sentences of plain text in a single mailbox belonging to a finance employee at a mid-sized U.S. municipal government's public works department. No links. No attachments. No dollar amount, no account number, no routing number. And every authentication check the message encountered on its way in returned a pass.

That combination is what makes this case worth an hour of anyone's attention. There was almost nothing here for a gateway to inspect, and everything that could be verified verified cleanly. The single defect in the entire message was that a trusted name was sitting on an address nobody in the department had ever seen.

Three sentences and a signature

The body read, in full, as a short favor: "Please I need assistance with a payroll change, as I'm unable to complete it on my end. I would like this update to take effect starting the next pay period." Then a signature block naming a manager in the utility department, complete with a plausible title and organizational line.

Nothing was asked for yet. No substitute bank details, no same-day deadline, no attachment to fill in. This is the reconnaissance beat of a payroll diversion, and the entire objective is a reply. Once a finance employee answers, the attacker moves the fraud into a live thread that already feels like an established conversation, and supplies the replacement account information there. The 2024 Verizon Data Breach Investigations Report identifies pretexting, the category covering most business email compromise, as the leading social-engineering type, with an industry-wide median transaction of roughly $50,000. The 2023 FBI Internet Crime Report counted about $2.9 billion in reported BEC losses. None of that money moves in the first email. It moves in the second or third one, after the recipient has already decided who they are talking to.

Zero payload is also a deliberate evasion. There is no URL to reputation-check, no attachment to sandbox, no macro to detonate, no redirect chain to unwind. As CISA's phishing guidance points out, the manipulation is the attack, and manipulation does not need a file. The relevant MITRE mapping is the phishing parent technique rather than either payload-bearing child.

Authentication did exactly what it was designed to do

Here is the part that should reset a few assumptions. SPF passed, because the sending IP was explicitly authorized to send for the sender's domain. DKIM passed with a valid signature under that same domain using the default selector. DMARC passed, with alignment confirmed against the From header. Composite authentication returned a perfect score of 100, the result Microsoft reserves for mail that shows no sign of forgery whatsoever.

None of those checks were fooled. They were answered honestly. The attacker had stood up a domain of their own and configured its DNS, publishing an SPF record covering the host they sent from, generated a DKIM key pair, and published a DMARC record. Every gate then correctly reported that the message genuinely originated from the domain it claimed. The specification behind all of this, RFC 7489, is precise about its own scope: it establishes that a domain in the From header is entitled to be there. It makes no claim about whether that domain has ever been trustworthy, or whether it existed last week.

One dissenting signal did survive. The spam confidence level landed mid-range even while composite authentication scored a flawless 100. Content and relationship heuristics were plainly uncomfortable with the message while the envelope was immaculate. That divergence, a pristine identity result next to an uneasy content result, is itself a finding worth alerting on.

See Your Risk: Calculate how many threats your SEG is missing

A single hop from generic webmail

The delivery path was as plain as the message. One external hop, from a host whose reverse DNS resolved to javelin[.]sfdns[.]net at 185[.]93[.]164[.]160, straight into Microsoft 365 protection and on to the recipient's mailbox. The host was running a common open-source mail transfer agent with a webmail client bolted on, the standard furniture of low-cost shared hosting, and the SOC narrative geolocated it to Cyberjaya, Malaysia. No commercial security gateway sat anywhere in the chain, and a WHOIS query on the sender's domain returned no public registration data at all.

That is the entire attacker infrastructure. A cheap hosting account, a webmail login, and correctly published DNS records, which MITRE tracks as establishing email accounts rather than compromising them. Nothing was stolen to build this. It was bought.

The name was real, the mailbox was not

The costume was the display name, and it was an exact copy. Not a near-miss with a swapped character, not an added middle initial, not a homoglyph. The precise display name of a manager the recipient genuinely knew and corresponded with, rendered character for character on an unrelated external address at the attacker's own domain. MITRE files this under matching a legitimate name, and the reason it works is a user-interface decision made decades ago: mail clients render the display name large and the address small, or omit the address entirely on mobile.

So the mismatch was never in the headers. It lived in the relationship history, and that is where our Adaptive AI analyst, Themis, found it. The platform already knew that display name, and it knew the address that name normally sends from, an address inside the department's own domain. This message used neither. Themis flagged it at 90 percent confidence, labeled it business email compromise and financial fraud, and stated the discrepancy in as many words: this name is known at one address, and this is not that address.

The message was caught by an automated scanback rather than by a human report. Nobody in the finance office had to feel suspicious first. That matters, because the manipulation here was low-friction by design and the DBIR found the human element involved in 68 percent of breaches. One mailbox was affected, and it was remediated.

Small tells, in hindsight

The soft signals were all present, and all easy to skip. The greeting rendered the word "hi" in all capitals followed by the recipient's first name, a tone anomaly no colleague produces twice. The phrasing, "Please I need assistance," is grammatically off in a way that reads as haste. The subject was a terse abbreviation rather than anything a payroll or HR workflow would generate. And the sender domain bore no relationship to the municipality, to any payroll provider, or to any vendor in the department's history.

Individually, none of that stops a message. Together with an address a known name has never used, it is decisive. The durable lesson is the one the authentication results state so cleanly: a full pass means an attacker did their DNS homework, not that the sender deserves your money. Any change to a bank account, a payroll destination, or a payment instruction has to be verified through a channel that existed before the request arrived, using a number you already had.

Indicators of Compromise

MITRE ATT&CK mapping