One JPEG, Two Attachments, Nothing to Scan

A shared accounts-payable mailbox at a healthcare services company received one message from a consumer webmail account. The subject line read "[EXTERNAL]: circling back on the email that came in", asserting a conversation already in progress. The platform recorded a first-time sender at high risk, with no prior contact in either direction. There was nothing to circle back to.

It made no request. Two attachments came with it, a PDF and a Word document, both with fifteen-character random uppercase filenames holding no vendor name, invoice reference or date. Both scanned clean, in the least useful sense: there was nothing inside to read.

The Same Picture, Delivered Twice

MF45BTE4HIOPJTY.pdf was 125,191 bytes. U2OOBYP7XZ0G1F5.docx was 143,987 bytes. Extract the single image out of each and the two are byte for byte identical: 123,759 bytes, the same MD5 in both containers.

One rendered asset, two wrappers. Coverage, not sloppiness: whichever viewer the clerk reaches for, the picture appears, and building both costs nothing once the image exists. The JPEG was a plain JFIF with an APP0 segment and no EXIF block, so no camera or software trail survived either.

A PDF With No Fonts and No Links

Direct inspection of the PDF bytes returned a short list. One page, one image XObject, DCTDecode compressed. Zero font objects, the structural confirmation that there is no text layer at all. Zero occurrences of a URI action, JavaScript, an additional-actions dictionary, an open action, a launch action or an embedded file. A link scanner found no link because there was none, and a sandbox no code for the same reason.

Its creation and modification timestamps were identical and landed two seconds before the message's own Date header. This was not a file exported from a billing system; it was generated as the message was composed.

The Word File Was Built by a Library

The DOCX told an even plainer story. Its document properties named python-docx as the creator and carried the description "generated by python-docx". The application statistics reported zero words, zero characters and zero paragraphs, and the document body was 2,369 bytes containing no text runs at all. Its relationship map held only internal package targets: no hyperlink, no external template reference, no OLE object, so the file makes no network request when it opens.

Two metadata fields deserve caution, not a conclusion. The created and modified stamps read as a date more than a decade old, and the application string claimed a Macintosh build of Word. Neither is evidence. Both are defaults baked into the library's starter template, so the file's apparent age and authoring tool are artifacts of the generator, and MITRE ATT&CK counts format choices that obscure content from analysis as a technique in their own right.

What the Picture Actually Said

Opening the extracted image is the only way to learn what the message wanted, and it was not an invoice. It was a QuickBooks branded account suspension notice: a generic "Dear Customer" greeting, a full service subscription plan, a billing date matching the very day the message arrived, and an invoice number matching no record. One section heading was misspelled as "Immidiate Action Required", a proofreading failure that survives only because nobody spellchecks pixels.

There was no payee, no bank account, no routing number, no payment-change request and no URL. The notice held one toll-free phone number, printed four times: on an orange call-to-action button, in the action paragraph, in the auto-renewal small print, and in a signature attributed to a billing team.

That number appears nowhere else. Not in the message text, not in a header, not in any platform field. The record's optical-character-recognition and QR extraction arrays are both empty, so nothing ever turned the image into text and the one malicious artifact in the message went unread.

Dialling it is the whole attack. Callback lures, tracked by MITRE ATT&CK as spearphishing voice and known to defenders as vishing, move the fraud onto a channel with no logging, where a live operator steers toward remote access or a card capture framed as cancelling the charge. The number is not among the vendor's published support lines, but the record holds no lookup against that directory, so treat it as unverified.

See Your Risk: Calculate how many threats your SEG is missing

Every Check Passed, and None Was About the Brand

Authentication at the receiving hop was flawless: SPF pass, DKIM pass with a verified signature for hotmail[.]com, DMARC pass, composite authentication 100. The outer ARC set validated, while the inner set recorded no SPF, no DKIM and no DMARC at all.

None of that is suspicious, and none of it is reassuring. An ordinary webmail account sent ordinary mail through its provider's outbound infrastructure, exactly as designed, which is why every signature verified. The policy that passed is the provider's own permissive consumer DMARC policy, and alignment as defined in RFC 7489 answers only whether the From domain authorized the message. It did. The QuickBooks brand inside the attachment was authenticated by nothing, because it was a drawing. The provider's filter did engage, appending a warning banner rather than blocking, and that banner's three links were the only links in the message.

One relational detail remains. The To header, and the ARC recipient-domain field, named a sibling corporate domain rather than the one the delivered mailbox belongs to. Invisible to a content check, plain in the envelope.

A Person Caught It

Nothing technical did. Both attachments scanned clean, all links scanned clean, every authentication and reputation check passed, and no confidence label was produced at all. The catch was human: the clerk on that shared mailbox reported it with a short comment amounting to not recognizing the sender. That is a relationship judgement, not a content judgement, and the same one the platform had already encoded as a first-time sender at high risk. Quarantine and permanent deletion completed roughly six minutes after arrival.

The 2024 Verizon Data Breach Investigations Report puts a human element in 68 percent of breaches. This case inverts that framing: the human element was the only functioning sensor, because it was the only one evaluating something other than text.

Where the Control Has to Sit

Three moves follow. Convert images in attachments to text and run body rules against the result, so a phone number in pixels lands in the same searchable field as one in prose. Score attachment structure in its own right, since no extractable text, a random filename, a send-time creation stamp and a generator string are all evaluable without reading the content, which is the structural work Themis, the IRONSCALES Adaptive AI analyst, does instead of waiting on a payload verdict. And stop reading a clean verdict as an examined one.

Then give finance teams one rule, consistent with CISA phishing guidance and the behavior NIST describes: never dial a number from an unsolicited billing notice. Look the vendor up independently. A callback lure only pays if somebody calls.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

Every scan result on this message was accurate. The lure was a picture, and nobody looked at it. Check back tomorrow.