The Handbook Phish With a Mortgage Lender Footer

The message wanted a signature. It announced itself as a securely delivered notice, told the recipient that updated employee handbook policies required leadership authorization, and attached a benefits PDF named after the recipient's own mailbox. Standard corporate housekeeping, aimed at the one person in the building whose sign-off nobody questions.

Then there was the footer. Underneath the handbook language sat two legal links: an Equal Housing Lender disclosure and a consumer privacy notice, both resolving to a major US retail bank's real website.

An employee handbook has no Equal Housing Lender obligation. That notice is required boilerplate on residential lending communications. Its presence at the bottom of an HR acknowledgment is not a clever touch of false legitimacy. It is a seam, and it tells you exactly where the template came from.

A Donor Template That Was Never Stripped

The two footer links pointed at genuine Bank of America pages, the equal housing disclosure and the consumer privacy notice. Worth stating plainly: the bank was not the impersonated party and it was not the target. Those links were inert. Nothing in the message asked the recipient to log in to a bank, and no bank branding appeared above the footer.

What they are is residue. Somewhere upstream, this kit was built for a lending or loan-servicing lure, the kind of pretext where mortgage disclosure boilerplate belongs. When the operator repointed it at an HR handbook pretext, the lure copy changed and the footer did not. That is the entire fingerprint: a template edited from the top down, abandoned before it reached the bottom.

One further artifact is worth naming precisely, because it is easy to attribute to the wrong layer. Both bank links arrived wrapped in a third-party URL-rewriting service, link[.]edgepilot[.]com. That wrapper is not part of the kit. It is click protection applied by a mail-security product in the delivery path, which rewrites every inbound URL it handles, hostile or benign, including a bank's genuine disclosure pages. It says nothing about the template, but as the authentication record shows, that rewriting had consequences of its own.

Recycled infrastructure is throughput, not sloppiness. Kits get bought, shared, and repointed at whatever pretext converts this week, which is why phishing keeps turning up across breach data year over year. The 2024 Verizon Data Breach Investigations Report put the human element in 68% of breaches and clocked the median time to click a phishing link at 21 seconds. Nobody in that window is auditing a footer.

The Lure Itself

The pretext was tuned for a single reader. The subject demanded leadership action on revised handbook policies, and an external sender tag was the only visible warning on the line. The sender alias read "Team Communications", sending from info@tandembe[.]com, a small-business domain with no prior relationship to the recipient. First-time sender, no history, no thread to hijack.

The body impersonated a secure delivery portal rather than a brand: a delivery confirmation block with a hard-coded timestamp baked into the template, a version label on the handbook, and a download action. Two details give away the automation. The kit rendered the recipient's own email address with the local part partly starred out, a crude imitation of the redaction real secure message portals apply. And the footer carried a copyright line that the kit had auto-populated with the recipient company's own legal name, a personalization touch that a genuine internal HR notice would never need to synthesize.

The attachment was a benefits-themed PDF of roughly 236 KB, named with the recipient's mailbox local part, and it scanned clean. That combination maps to MITRE ATT&CK T1566.001 (Spearphishing Attachment) for delivery and T1656 (Impersonation) for the manufactured internal authority. The target was the company's chief executive at a power and energy services company, which is the whole reason the handbook framing works: policy sign-off is a genuine part of that job, so the request never has to sound like fraud. NIST's own definition of phishing turns on that deception of a legitimate request, not on any technical payload.

Two Gateways, Two Verdicts, One Message

The authentication record on this message looks contradictory until you account for the delivery path. Microsoft evaluated it as a clean sweep of failures: SPF fail, DKIM fail on both the sender domain and the ESP domain, DMARC fail with action=none, and compauth=none reason=405. Meanwhile the inbound security gateway that handled the message before Microsoft stamped its own headers recording SPF pass, DKIM pass for the sender domain, and DMARC pass.

Both are accurate at the point they were measured. The mail left an Amazon SES region from 23[.]249[.]208[.]18 and was received by a relay at 8[.]31[.]233[.]192. That relay is the IP Microsoft subsequently checked SPF against, and it is not authorized to send for the ESP domain, so SPF failed structurally rather than suspiciously. Both DKIM signatures failed specifically on body hash, meaning the body Microsoft verified was not byte-identical to the body that was signed. One relay that rewrote links in transit explains all three failures at once, and explains why the gateway upstream had every right to log a pass.

The lesson is that an authentication verdict describes a hop, not a message. DMARC's reporting and enforcement model assumes alignment survives the path; when a rewriting relay sits in front of the mailbox provider, it often does not, and a policy set to take no action turns the failure into a note rather than a block.

See Your Risk: Calculate how many threats your SEG is missing

How It Was Resolved

Nothing in the sender infrastructure was blocklisted, the attachment was clean, and the strongest tell sat in footer markup no scanner reads. So the signal had to come from behavior. Themis, the IRONSCALES agentic AI analyst, flagged the message at moderate confidence with two labels that matter more together than apart: credential theft and VIP recipient. An unknown first-time sender making an authority-framed request of a top executive is a shape worth surfacing even when every individual artifact looks benign.

Moderate confidence is exactly where the human element of the model earns its place. Rather than auto-resolving on a borderline score, the case went to analyst review and was manually confirmed as a real attack. That division of labor, machine triage on volume and human judgment on the ambiguous remainder, is the practical answer to kits that are cheap to repoint, and it is why credential harvesting protection across the IRONSCALES platform is built around adaptive behavioral signals instead of static reputation. For teams hardening their own controls, the CISA guidance on stopping the phishing attack cycle remains the practical baseline.

Indicators of Compromise

Two of those indicators are a real bank's genuine web pages, which is a useful reminder that not every URL in a phishing email is hostile. Some are just evidence. The footer nobody bothered to delete is often the most reliable thing in the message.