The Leftover Footer Link That Unmasked an Invoice Scam

An invoice demand landed in the inbox of a US-based oncology treatment practice, and on paper it was flawless. The sending domain, hitch[.]bm, belonged to a real Bermuda-registered company that had been on the internet for the better part of a decade. SPF passed. DKIM passed. DMARC passed with an alignment reason of 100. To any gateway checking the technical envelope, this was a clean, authenticated message from an established business. The only thing wrong with it was everything the authentication could not see.

The ask was deliberately thin. There were no bank account numbers in the body, no payment portal, no wire instructions, and no attachment full of macros. Just a single PDF styled as an invoice, roughly 420KB, that static and antivirus scanning waved through as clean, paired with a bare, urgency-only demand to settle a referenced invoice number before the end of the day. Everything about the message was engineered to feel routine to a busy finance inbox and to give an automated filter nothing to grab onto.

Authentication that told the truth about the wrong thing

The reason this message authenticated so cleanly is also the reason it was dangerous. hitch[.]bm is not a domain an attacker registered last week to spoof a brand. It is a genuine, aged company domain, and the mail really did originate from that domain's own sending infrastructure. When the mail flow is legitimate, SPF, DKIM, and DMARC all align by design. The most likely explanation is that the sending capability behind that domain was abused or compromised, not that someone forged their way into looking like it.

This is the trap in trusting authentication as a verdict on trustworthiness. SPF, DKIM, and DMARC answer a narrow question: did this message come from where it claims to come from? They say nothing about whether the request inside is real. A compromised or abused legitimate account inherits all the reputation and all the passing checks of the real owner, which is exactly why account takeover is such a durable delivery method. Protecting the sending identity itself, through account takeover protection, matters precisely because a clean auth result is not a clean bill of health.

A signature block for a different brand

The first crack in the story was the signature. The message authenticated as the Bermuda company, but it signed off as a completely unrelated brand, a business-coaching franchise with no connection to the sender domain and no connection to an invoice for an oncology practice. Two different identities were stapled to the same email, and they could not both be genuine.

That contradiction is a fingerprint of a recycled phishing kit. Attackers running invoice fraud at volume do not hand-craft each message. They work from a template and swap in a fresh target, a fresh invoice number, and a fresh subject line, then fire it off. When they move fast, they forget things. Here they forgot to replace the signature block from a previous campaign, leaving the coaching franchise's branding sitting under a message it had nothing to do with.

The leftover link that gave it away

The second, more damning artifact was in the footer. Buried at the bottom of the HTML was a privacy-policy link pointing at hxxps://netvigator[.]com/en-en/privacy[.]html, the privacy page of a Hong Kong internet service provider. It was clean, it was harmless on its own, and it had absolutely no reason to be there. It matched neither the Bermuda sender domain nor the coaching franchise in the signature nor the oncology practice being targeted.

A leftover link like this is the digital equivalent of a receipt from a different store falling out of a repackaged box. It is template residue: HTML lifted from one campaign, dropped into another, and shipped without a full scrub. On its own the link was not an attack. As evidence, it was conclusive. Three unrelated identities in one email is not a coincidence, it is a reused kit.

A quiet payload by design

It is worth dwelling on how little the message actually contained, because the emptiness was the strategy. No bank details meant nothing for content filters to fingerprint. The clean PDF meant sandbox detonation found nothing to detonate. The whole message leaned on one pressure lever, a same-day deadline on a referenced invoice, betting that urgency plus a passing auth result plus a plausible-looking PDF would move a payment before anyone stopped to verify the vendor.

This is textbook business email compromise economics. The 2024 Verizon Data Breach Investigations Report puts the median transaction amount in a business email compromise incident at roughly $50,000, and it names pretexting, the social-engineering category that includes BEC, as the top social-engineering type of the year. The report also found the human element present in 68% of breaches. Attacks like this one are cheap to send and profitable to land, which is why disciplined business email compromise protection treats every unsolicited payment demand as unverified until confirmed through a channel outside email.

How the fraud was actually caught

None of the technical checks a legacy gateway relies on fired here. Authentication passed. The attachment scanned clean. There was no malicious link to blocklist and no known-bad domain to match. The case surfaced instead on a behavioral community-pattern signal, with the platform's Adaptive AI confidence sitting at only 50%, low enough that it read as a signal to escalate rather than an automatic verdict.

That escalation put the message in front of a human analyst, who confirmed the fraud on exactly the two tells no auth check could ever produce: the signature block for a brand unrelated to the sender, and the leftover Hong Kong ISP footer link exposing the recycled template. The message was manually approved as malicious not because of a signature match or an external blocklist, but because the story it told about itself did not hold together. Machine pattern-detection narrowed the field, and human judgment closed it, which is how you catch the attacks that are designed to pass every box a filter can tick.

Indicators of Compromise

MITRE ATT&CK Mapping

For a broader baseline on defending against attacks that start with a message like this one, CISA's phishing guidance on stopping the attack cycle is a useful reference, and the 2024 Verizon Data Breach Investigations Report documents just how often the human element, not a technical failure, is the way in.

See You Next Friday

Clean authentication is a starting point, not a conclusion. When a message passes every technical check but signs off as the wrong brand and carries a footer link from a company nobody in the conversation has heard of, the template is talking. The attackers here did the hard part, standing up authenticated delivery, and then gave themselves away on the easy part, forgetting to finish the cut-and-paste. Read the whole message, verify every payment demand off-channel, and remember that the residue an attacker leaves behind is often the clearest evidence you will get.