The Phishing Kit That Emailed Us Its Own Billing Meter

Almost everything defenders say about the business of phishing is inferred. We cluster infrastructure, estimate volume from what lands in mailboxes, and reason backwards to what the operator must have bought. On September 4, 2026, one message removed the inference step. Delivered to the chief executive of a regional grocery-retail chain in the US Midwest, it carried, below the lure in the same HTML body, a verbatim copy of the web console of the phishing service that sent it.

A licence meter arrives in an inbox

The top of that pasted panel is a billing readout: Enterprise Plan ACTIVE, Subscription 23 days remaining, and a lifetime counter of Emails 138,291. Three add-on meters beside it, Validations 0, MX Lookups 0 and Intelligence 0, all read zero, so whatever those services do, this tenant had not used them. Around them sits a working web application: a logout control, a tab strip from Send and Leads through SMTP Config and Proxy, and an empty-state line reading No saved campaigns.

That is not the fingerprint of a bespoke adversary. It is a subscription product with a usage meter, and the sender is a paying tenant rather than the author of the tooling. The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of initial access vectors and the human element in 62% of breaches, and frames AI as an operational shift. A metered panel with a template generator and a lead loader is what that looks like at retail.

The counters prove the console was live

A leaked banner could be filler. Arithmetic is harder to fake. The log prints three batch headers, each pairing progress and throughput with an estimate and a wall-clock time: 0 of 4,043 leads at 0.0 per second; 26 seconds later, 25 of 4,043 at 1.0 per second, estimate 69 minutes 18 seconds; 33 seconds after that, 50 of 4,043 at 0.9 per second, estimate 78 minutes 12 seconds.

Work it through. Twenty-five messages across 26 seconds is 0.96 per second, which rounds to the displayed 1.0, and the 4,018 leads still queued at that rate come to roughly 69 minutes, matching the printed estimate. Fifty across 59 seconds is 0.85 per second, displayed as 0.9, and the 3,993 remaining come to roughly 78 minutes. Static text cannot carry estimates that correctly integrate the elapsed times beside them. This was live application state, pasted into the custom-HTML field of the same panel, which notes that operator HTML is appended below the generated template.

What the panel disclosed about its own campaign

Read as intelligence, the panel volunteers parameters an analyst would normally triangulate over weeks. It boots with a campaign-engine banner, reports Loaded 4043 leads, declares the engine armed with one SMTP server, and runs 25 sends in parallel with a zero millisecond batch delay. The selected template carries a brand-styled label, Document Invite (Angi Style), advertised in the panel as generating unique brand-accurate HTML per recipient.

Then the log body: exactly fifty successful delivery lines carrying a 250 response code, to fifty distinct mailboxes across forty-nine distinct recipient domains. We are publishing none of them. They are real people at uninvolved operating companies in commercial construction, industrial distribution and maintenance procurement, targeted by other sends and not parties to this incident. Note also what the log is not. Every logged delivery leaves through a single relay host on port 587, while the message that arrived travelled through an email service provider, so this is a log from a different leg of the same operation, on different infrastructure, using the same kit and template family.

See Your Risk: Calculate how many threats your SEG is missing

The leak supplied the entire gateway score, and it still was not enough

The cloud gateway on the receiving side fired three rules. Two, one for HTML content and one for an unparseable relay, contributed 0.00 each. The third, which flags a URI using a non-standard HTTP port, contributed 0.50, for a total of 0.50 against a kill threshold of 3.0. A regex for non-standard-port URIs across the whole message returns exactly one match: the relay host and port printed inside the leaked console log.

So the only signal that carried any weight was the self-disclosure in the leak, at one sixth of the blocking budget. Everything conventional was quiet, and the malicious destination sat under four layers of URL rewriting whose individual scans returned Clean and Mixed Result.

Detection came from the composite instead: a malicious verdict on the final destination, exact display-name impersonation firing because the platform had already seen the display name Noreplysign arrive from a different abused sending domain, and community reputation similarity. Themis, our Adaptive AI, recorded 88% confidence with labels for credential theft and VIP recipient. One mailbox was affected, mitigated six seconds after receipt.

Two corrections worth making out loud

This was not a spoof, and the automated narrative that called it one read the wrong hop. At the true inbound edge the message passed SPF; DKIM was not evaluated there and the sending domain publishes no DMARC record, and neither of those is a failure. The failure pair visible downstream was manufactured by the topology on the receiving side, where a cloud gateway hands off to an on-premises relay before Microsoft checks that relay address against the provider envelope domain. The body hash broke after signing, coincident with inbound rewriting.

Nor was anything here attacker-registered. The relay host named in the log dates to March 2011, sits on Japanese hosting, and publishes no registrant data. The sending domain belonged to a real insurance brand whose provider account was abused, and the mail was genuinely signed for it. The landing page sat at a /sales path on a compromised legitimate website owned by a private individual. Calling any of that attacker infrastructure would accuse bystanders. What the sender demonstrably controlled, besides the staged page, was a subscription account inside a service somebody else built and sells.

The body was three careless strata: the lure card, a padded block of stolen third-party content we will not describe, and the live console.

Indicators of Compromise

Recipient-side URL rewriters are excluded: they belong to whoever received the mail, and three of the four layers here belonged to other organisations. So is an unattributed toll-free number in the footer.

MITRE ATT&CK mapping

• T1566.002 Phishing: Spearphishing Link: one document-invite link to a named executive mailbox.
• T1584.001 Compromise Infrastructure: Domains: the aged relay host and the compromised hosting site.
• T1586.002 Compromise Accounts: Email Accounts: the abused provider sending account.
• T1588.002 Obtain Capabilities: Tool: the licence meter itself, rented rather than built.
• T1204.001 User Execution: Malicious Link: the single call to action in the lure.

The defensive read

A leaked toolmark is a free, high-fidelity signature, and this leak class is structural rather than freak: kits invite the operator to paste custom HTML, and panels live in the same clipboard. Kit banners, a lead-loader line, a repeating delivery log and a licence meter are ordinary body strings, cheap to match and easy to score heavily. Both the CISA phishing guidance and the NIST definition of phishing point the same way: behaviour and content, not sender reputation.

The economics are the part to sit with. A tenant with 138,291 lifetime sends, 4,043 leads loaded, one relay and 23 days left on an Enterprise plan does not need to be clever. That account needs to renew. Defences priced against bespoke attackers are mismatched against a subscription, which is why behavioural detection and credential-harvesting protection met this message when authentication could not.