Fully Authenticated, Completely Fake Vendor Invoice

The email that landed in a CFO's inbox at a property-management company passed every authentication check an email security stack knows how to run. SPF passed. DKIM passed. DMARC passed and aligned. The compound authentication verdict came back a clean 100. By every server-level signal, this was a trustworthy message from a domain fully entitled to send it.

It was also a vendor invoice scam, and the domain doing all that clean authenticating had nothing to do with the company named in the From field.

A Real Sender Standing in for a Fake One

The display name read like the accounting team at a well-known cloud-infrastructure software vendor. The actual authenticated domain belonged to a legitimate, decade-old staffing and recruiting firm, sending through Amazon Simple Email Service (SES). That distinction is the entire attack.

Amazon SES signs mail for whatever domain a customer has configured and verified. The infrastructure has no opinion about whether the display name matches the sending domain or whether the recipient has any relationship with either party. When the staffing firm's mail identity was abused to push this message, SES dutifully produced valid DKIM signatures for that firm's domain, SPF passed on the SES sending address, and DMARC aligned to the header From. Everything was cryptographically correct and contextually meaningless.

This is the part defenders keep relearning: authentication validates the sender's domain, never the sender's intent. A green DMARC verdict tells you a message came from a domain authorized to use that infrastructure. It says nothing about whether that domain is the one the reader thinks they are hearing from, and nothing about whether the account behind it is behaving honestly.

The Reply-To Did the Real Work

The impersonation set the stage. The payoff was hidden one header lower.

While the From address authenticated cleanly to the staffing firm, the Reply-To was silently redirected to billing@aiaas-solutions[.]com, a privacy-shielded domain registered just nine days before the message was sent. Nothing in the visible email hinted at the switch. A CFO reading a vendor invoice and hitting reply with a question, a confirmation, or a request to verify banking details would send that reply not to the software vendor, not to the staffing firm, but to a brand-new domain the attacker controlled.

That nine-day-old registration is the behavioral fingerprint of this whole class of fraud. A real vendor relationship runs on established domains and known contacts. An attacker preparing a business email compromise run stands up disposable infrastructure days before the send and discards it after. The Reply-To hijack is what converts a convincing-looking message into a working fraud channel, and it is invisible to any check that only inspects the authenticated From.

See Your Risk: Calculate how many threats your SEG is missing

The Lure: Pay This Week for the Discount

The body carried a familiar pressure lever. It urged the recipient to process payment this week to secure a discount, the small, plausible incentive that pushes an accounts-payable decision past scrutiny and toward action. Attached were two PDFs: an invoice and a W9 tax form, the exact document pair a finance team expects to see when onboarding or paying a vendor.

Both attachments scanned clean, and here honesty matters more than a dramatic finish. The security tooling could not extract the contents of either PDF, so the remit-to and banking details inside were never confirmed. The verified fraud is not anything hidden in those files. It is the header impersonation and the Reply-To hijack, which together are enough to route a payment or a sensitive reply to the wrong hands. A hidden 1x1 tracking pixel on a subdomain of the sending domain quietly confirmed when the message was opened, giving the operator a live signal that a real person was reading.

Mapping to MITRE ATT&CK

The tradecraft maps cleanly onto the MITRE ATT&CK framework:

• T1566 Phishing and T1566.001 Spearphishing Attachment cover the delivery: a targeted message carrying invoice and W9 attachments as the pretext.
• T1656 Impersonation covers the display-name deception, a vendor's accounting identity worn by an unrelated authenticated sender.

The nine-day-old Reply-To domain reflects the establish-accounts side of the same playbook: attacker infrastructure stood up specifically to capture the victim's response off to the side, well clear of the domain doing the authenticating.

Indicators of Compromise

Why Static Checks Cleared It

Every gate a traditional gateway leans on returned a pass. Authentication aligned. Attachments scanned clean. The sending domain carried a legitimate, aged reputation. There was no malicious link to detonate and no malware to catch. A reputation-and-signature model has nothing to grab onto here, which is precisely why this pattern keeps landing.

Detection has to shift to the relationships between the pieces. The mismatch between a vendor display name and an unrelated authenticated domain. A Reply-To that diverges from the From and resolves to a domain registered days ago. Payment urgency paired with a discount hook aimed at a finance decision-maker. Themis, the Adaptive AI analyst on the IRONSCALES platform, reads those signals together the way a seasoned analyst would, flagging the impersonation and the reply diversion even when every server-level check comes back green.

The context backs the pattern up. The 2024 Verizon Data Breach Investigations Report names pretexting, the category that covers most business email compromise, as the top social-engineering incident type, with a median BEC transaction around $50,000, and puts the human element in 68 percent of breaches. The Microsoft Digital Defense Report 2024 documents the same tilt toward abusing trusted services rather than breaking them. The FBI's 2023 Internet Crime Report likewise puts business email compromise among the costliest categories year after year, and across 17,000+ organizations and 35,000+ security professionals the IRONSCALES community sees the same story: the invoice that beats every filter is usually the one that never had to break anything.

The Takeaway

A clean authentication verdict is a starting point, not a conclusion. This message proved that a real domain can pass SPF, DKIM, and DMARC in full while the human behind it is lying about who they are and where a reply should go. The durable defense is to treat the From as one signal among many, inspect the Reply-To on any payment-related message, and verify vendor banking changes through a known channel rather than the thread that requested them. Static gateways clear traffic like this by design, which is why closing the gap on vendor email compromise takes detection that reasons about intent. For building that reflex across a finance team, CISA's guidance on stopping phishing early is a solid reference: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one