SAM.gov CAGE Code Scam Passes Every Auth Check

An engineering and infrastructure-consulting firm that works as a federal contractor got an email demanding a fee to keep a government registration that is free. The subject line carried the firm's real CAGE code and the phrase "Registration Requirement," dressed up to look like a mandatory compliance action. The message passed SPF, DKIM, and DMARC without a single failure.

None of that was the interesting part. The interesting part is that the same firm got hit again, and again, over roughly two months, with near-identical lures referencing at least two different CAGE codes. This was not an attacker who studied one company. This was an automated campaign working a scraped list, and the target kept surfacing because its registration data is public record.

The repeat hits came from public data, not reconnaissance

SAM.gov is the federal government's official registration system for contractors. CAGE codes and registration points of contact stored there are public and searchable. That transparency is the point of the system, and it is exactly what the attacker weaponized.

There was no individualized recon in this campaign. The attacker scraped registration records at scale, mail-merged the results, and fired. The proof sits in the plumbing: the unsubscribe link encoded a base64 token that embedded the recipient's own email address, the signature of a bulk mailing tool tracking a large list, not a hand-crafted message to one victim. When you see the same organization targeted repeatedly with different CAGE codes swapped in, you are looking at list automation, not attention.

That distinction matters for defenders. You cannot make yourself a smaller target by being less interesting. As long as the data is public, the list refreshes, and the lures keep coming.

Authentication passed because the attacker owned the domain

Here is the part that breaks a lot of email defenses. The sending domain was registered roughly seven months before it was used, through a privacy-protecting registrar, and it passed SPF, DKIM, and DMARC cleanly.

There was no spoofing. The attacker did not forge a government address. They bought a domain, configured it correctly, and sent from infrastructure they controlled outright. SPF, DKIM, and DMARC exist to confirm that a message genuinely came from the domain in the From header. They are silent on whether that domain has any legitimate relationship to the entity it is impersonating. A perfectly authenticated email can still be a total fabrication.

That is why authentication-based filtering is the wrong lens for this attack. Every check a gateway runs on the header comes back green. The 2024 Verizon Data Breach Investigations Report found phishing present in 15% of breaches and the human element a component of 68% of them, and campaigns like this one are why: the message reaches an inbox looking legitimate by every mechanical measure, then leans entirely on human urgency.

The disclaimer that made it look legal

The body did the impersonation work. It threatened the loss of "registration status," dangled the risk to "federal funding," and assigned the recipient a "Renewal Compliance Advisor" to create the feel of an official caseworker. The call to action, a "BEGIN PROCESS NOW" button, pointed at a paid third-party intake page.

Buried at the bottom was a footer disclaimer stating that the sender had no government affiliation and that fees applied. Technically present. Practically invisible under a wall of mandatory-sounding compliance copy. That combination, an official government mandate on top and a tiny non-affiliation-plus-fee disclaimer at the bottom, is the reliable fingerprint of this scam class. The disclaimer is there to give the operation legal cover, not to warn the reader.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

The technique maps cleanly to MITRE ATT&CK: T1566.002 Spearphishing Link for the mandate-driven CTA to the paid intake page, and T1583.001 Acquire Infrastructure: Domains for the purpose-registered, privacy-protected sending domain. Note the "[CAGE]" placeholders above. Publishing a real CAGE code would identify the victim through a public SAM.gov lookup, so we redact it here.

Where authentication filtering goes blind

Strip away the header and the discriminating signals are all about content and intent. A registry mandate arriving from a commercial, non-.gov domain. A demand for payment tied to a service the government provides for free. A non-affiliation disclaimer buried under urgency. Those are the tells, and none of them show up in an SPF, DKIM, or DMARC result.

This is the gap our Adaptive AI is built to read. Themis evaluates the message the way a trained analyst would, weighing brand-and-mandate impersonation, the mismatch between an official-sounding demand and its commercial origin, and the presence of a buried fee disclaimer, rather than trusting a clean authentication result. IRONSCALES platform data shows secure email gateways miss an average of 67.5 phishing emails per 100 mailboxes each month, and government-registry impersonation like this is precisely the content-and-intent category that slips through header-based defenses. That is why the 35,000+ security professionals across 17,000+ organizations in the IRONSCALES community increasingly treat authentication as necessary but nowhere near sufficient.

The U.S. Cybersecurity and Infrastructure Security Agency makes the same point in its phishing guidance: the durable defense is recognizing the manipulation pattern, not trusting any single technical indicator. NIST similarly defines phishing around the deception itself, not the delivery mechanism.

Judge the mandate, not the header

If an email claims a government registration is at risk, verify the claim at the source, never through a link in the message. SAM.gov registration and CAGE assignment are free, so any fee attached to keeping them is a solicitation, not a requirement. Train your finance and administrative staff, the roles these lures target, to treat a green authentication result as meaningless once the content is impersonating a government body from a commercial domain. The header can be perfect and the email can still be a lie.