The Proposal PDF Built Minutes Before It Was Sent

Four mailboxes at a workforce and staffing marketplace platform received the same message within the same minute, and not one of them could tell. The To field named exactly one address, and that address belonged to the sender.

The subject was High priority proposal (attached), Ref ACT-4417-HP. The body was a single sentence: "Please find attached the high-priority proposal, prepared for your review." Attached was a 51,293-byte file named acent_techs_proposal.pdf.

The sending domain was real. It belonged to a small phone-systems and VOIP integrator with a working website, live social profiles, and a registration record going back more than five years. Google Workspace handled the outbound leg and signed the message on the way out. No lookalike domain, no throwaway registration, no ugly relay hop.

The attachment is where it falls apart. It was not a proposal that a person wrote, saved, and attached. It was rendered from raw HTML by a command-line converter at essentially the same instant the mail was sent, and its only functional content was a hidden link annotation pointing at a hosted page with no relationship to the sender's company website.

The recipient list nobody could see

Take the header first, because it is cheap to check and gives up the most.

Addressing a message to your own mailbox and putting the real targets in Bcc is old, boring, and effective. Four colleagues at one company each believed they had been contacted individually about a high-priority proposal. The fastest check available to any of them, walking the message down the hall and asking whether anyone else got it, was quietly disabled by one header field.

It also keeps the visible envelope tidy. A recipient inspecting the headers sees a To address that genuinely belongs to the sending domain and no distribution list to raise an eyebrow at. The mass-mailing shape is only visible from the receiving side, where four near-identical deliveries landed together.

One of those four mailboxes carried a VIP recipient label, meaning the account was already designated as higher value than average. The blast was indiscriminate in delivery, precise in outcome.

Authentication that passed and failed at once

SPF returned none. The sending domain publishes no SPF record at all, so there was nothing to evaluate. DKIM passed, with a valid signature produced by the mail platform's own Google Workspace signing domain rather than by the company's own domain. DMARC therefore failed on alignment, because neither authenticated identifier lined up with the domain in the visible From header. And it did not matter, because the published policy was p=NONE. Nothing was enforced. ARC passed, confirming the message was not modified in transit.

To an analyst that reads as a signal, an aged business domain in active use that never published SPF and never moved off monitoring mode. To a filter tuned on reputation it reads as a shrug, because the mail came from Google's own outbound infrastructure into a Google-hosted mailbox.

See Your Risk: Calculate how many threats your SEG is missing

A document that was never a document

Open the attachment metadata and the story stops being ambiguous. The Creator field named wkhtmltopdf 0.12.6, an open-source utility that converts HTML to PDF from the command line. The Producer field named the Qt rendering library it depends on. The creation timestamp matched the send timestamp to within minutes.

Nobody writes a proposal that way. A real one is drafted, revised, saved, and then attached, and its metadata reflects that history. This file was output by a script at send time from an HTML template, which means the "proposal" was never a business document. It was packaging.

Inside that packaging was one functional element: a URI annotation, the PDF structure that makes a region of a page clickable, pointing at a subdomain of a public site-builder platform, named to read as an invitation center for the sender's company. The real company website sits on a completely different domain. The landing page answered live with a valid certificate, which tells you the infrastructure was working, and nothing more.

That placement is the point. A link annotation lives in the file structure, not the message body, so link-rewriting and body-scanning controls can miss it unless something parses the attachment and extracts annotations. MITRE tracks the delivery pattern as spearphishing attachment, and treating an attachment-borne link with the same suspicion as a body link is the gap that malicious URL and attachment protection exists to close. A page that scans clean today can serve something else tomorrow.

Reading it as a probe, not a payday

There was no invoice, no bank detail, no credential form in the mail itself. The analyst tag on the incident was a business email compromise availability check, and that framing fits everything visible here.

An availability check asks a cheap question: which of these mailboxes are live, monitored, and willing to engage with an unsolicited proposal? Answer it once and the follow-up can be tailored and pointed at a payment or document request later. MITRE catalogues that first move as phishing for information.

The economics behind it are documented. The 2024 Verizon Data Breach Investigations Report puts pretexting, largely business email compromise, at the top of the social-engineering list with a median transaction around $50,000, and the 2023 FBI IC3 Internet Crime Report records roughly $2.9 billion in reported BEC losses. Recon blasts are the front door to that number, which is why BEC protection has to grade unsolicited first contact rather than wait for a wire request to appear.

Worth being precise, because the record does not settle the mechanism. A real, aged, authenticated account sent this, which is consistent with a hijacked mailbox. The self-addressed header, the hidden recipient list, the attachment generated at send time, and the off-domain landing page are equally consistent with a sender being deliberately deceptive. Either reading leads to the same handling, and claiming certainty would invent detail the evidence does not support.

What actually caught it

Nothing in the envelope was going to catch this, so behavior had to. Our Adaptive AI, Themis, surfaced the message against the VIP designation on one of the recipient accounts, and a human analyst reviewed the classification and approved it manually. All four mailboxes were quarantined, then mitigated and reverted the following day once the scope was understood. A colleague on the same team reported the message independently, which is the shape healthy detection takes: automation narrows the field, a person confirms it, and the recipients corroborate.

CISA's phishing guidance makes the same structural point. Break the cycle at the earliest stage you can observe, because the recon message is the cheapest one to stop. As NIST's definition of phishing frames it, the mechanism is deception of a person, and there was no technical deception in this message to alert on.

Indicators of Compromise

MITRE ATT&CK mapping

See you next time

The interesting artifact here was not the domain or the link. It was a timestamp. A file created seconds before the email that carried it is not a document, and any control that reads attachment metadata can see that without resolving a single URL. Aged domains, valid signatures, and legitimate sending infrastructure describe how a message arrived. They say nothing about whether the thing attached to it was ever real.