A Phishing Kit Padded Its Payload With Someone Else's Mail

The subject line was empty. The visible body ran four lines. Everything a header check could ask of this message came back clean: SPF passed, DKIM passed twice, DMARC passed, and Microsoft's composite authentication returned a pass with reason 100, its strongest available verdict.

Then, underneath those four lines, the raw HTML ran on for roughly seventy blank line breaks and resumed with the complete markup of a legitimate commercial email that had genuinely been sent to somebody else, at an unrelated organization, footer boilerplate intact.

That filler is the interesting part. The kit was padding its payload with stolen legitimate mail.

Four Lines, and the Recipient's Own Company Name in the Sender Alias

The lure was thin. It addressed the recipient by first name, quoted their full email address back at them, announced that final approval documentation was ready, and pointed at a single link labelled as a signer approval settlement agreement carrying the recipient company's own name. Two mailboxes at a food service packaging manufacturer got it.

The sender alias asserted that same company name, and the platform's impersonation analysis tagged it as exactly that. No authentication mechanism has an opinion about the words a human reads in a sender alias.

A Campaign Tracking String Where the Mailbox Name Belongs

The address behind that alias is the strangest artifact in the record. Its local part is not a plausible mailbox at all. It is a malformed marketing automation tracking blob: utm_medium, utm_term, utm_campaign and utm_content values run together, followed by Dynamics 365 digest and secret version parameters, ending in a short random string. Somebody built this kit by pasting a scraped tracking string into the field where an address goes.

The sending domain, iamlookingfor[.]org, was first registered back in 2001 and signed this message with its own DKIM key, which is why DMARC returned a pass with action=none. Aligned DKIM proves whoever sent this controlled that domain's DNS. It does not prove they bought it. The registrant is privacy shielded, and nameservers moved onto a large CDN operator roughly a month before the send, which reads as a dormant asset repurposed rather than infrastructure bought for a campaign. Either way, the check did what RFC 9989 says it does: it compared domains, and the domains agreed.

One Anchor, Two Destinations, Three Layers of Cover

The single call to action carried hover text that disagreed with its own destination. The anchor's title attribute advertised a short, unrelated commercial domain. Its href went to a Mandrill click tracking URL, which relayed to a credential page on secure[.]individual-elegance[.]co[.]za. The platform scored the tracker as a mixed result and the terminal page as outright malicious.

That destination sits on a domain created in 2014 through a South African registrar. Attackers do not usually buy decade old domains with real registration history, so the profile fits a compromised small business site pressed into service as a hosting surface. The apex is another party's property, and blocking it lands on a bystander.

Stack the three: hover text that lies, an unblockable ESP tracker hostname, and a landing page with clean history. This is T1566.002, Spearphishing Link, delivered under T1036.005, Match Legitimate Name or Location. Every hop returned a reassuring answer to a question that did not matter.

See Your Risk: Calculate how many threats your SEG is missing

Seventy Blank Lines, Then Somebody Else's Email

Below the lure, the message ran roughly seventy consecutive blank line breaks and then reproduced a block of unrelated legitimate commercial email content lifted from elsewhere and used as filler: template markup, tracking links, footer boilerplate, and even the external sender caution banner the original recipient's own gateway had stamped onto it. We are not reproducing any of it or naming the organizations involved. The party whose mail was taken is a bystander with no connection to this target.

What that padding does is worth spelling out. A four line lure with one link is a thin document, and thin documents look suspicious by the numbers: almost all of the content is the ask, and the single link is the whole message. A long block of real commercial markup changes every one of those ratios at once. Link count goes from one to more than a dozen, all of the new ones resolving to reputable destinations that score clean. Text volume multiplies. Disclaimer boilerplate appears where a classifier expects it.

The IRONSCALES platform's own link extraction pulled all of those clean links out of this single incident, proof that the borrowed block travelled inside the phishing message rather than two records being spliced.

The blank line breaks are the human half of the trick. On render they push the borrowed content far past the bottom of the window, so a reader sees a short note, empty space, and stops scrolling. A parser has no fold. It reads a long, ordinary, link rich marketing message with a slightly odd top.

There is a colder implication. Mail stolen in some earlier incident is now a consumable input to a phishing kit, spent as packing material.

What Detection Actually Had to Work With

Take authentication out of the evidence pool, because it proved nothing here, and the rest is still enough. External mail asserting the recipient's own company name. A mailbox local part made of tracking parameters. An empty subject. An anchor whose hover text contradicts its href. A tracker resolving to a page a scanner calls malicious.

Themis flagged the disguised settlement agreement link as malicious, noted that the message looked like it came from the recipient's own organization but was sent from somewhere unrelated, matched community reputation signals from prior reports, and scored it at 89% confidence with a credential theft label. Both mailboxes were quarantined and mitigated. Conceding provenance and letting behavior carry the verdict is what Adaptive AI is for.

The 2026 Verizon Data Breach Investigations Report puts phishing at 16% of breach initial access vectors and credentials in 39% of breaches across the full kill chain, which is why credential harvesting is worth this much staging.

Practical Controls for Padded Messages

Normalize before you score. Strip long runs of blank line breaks, detect appended blocks of unrelated markup, and recompute link ratios and text volume against the actual payload. Padding only works on a classifier measuring the message as delivered.

Treat a display name asserting your own organization on inbound external mail as a first class alert. It is a deterministic comparison and it fired here.

Parse the local part, and diff an anchor's title attribute against its href. A mailbox name containing utm_ parameters or hundreds of characters is not a person, and a title-versus-href mismatch has no legitimate use in transactional mail. Both are cheap to compute and need no reputation data.

Resolve ESP click tracking wrappers to their terminal destination and judge that, and when it is a long lived site with genuine history, block the URL rather than the apex. The CISA phishing guidance argues the same for layered behavioral controls, and the NIST definition of phishing is about deceiving a reader, which no header field can attest to.

Indicators of Compromise

MITRE ATT&CK Mapping

The Bottom Line

Padding is not new, but stealing somebody else's real mail to do it is an escalation. Random filler is detectable as random filler. A genuine commercial email, with working links to reputable destinations and a footer that says all the right things, is indistinguishable from legitimate bulk mail because it is legitimate bulk mail. The attacker contributed four lines and one link, and let a stranger's correspondence carry the statistical weight.