One Button, Four Destinations, One Honest Field

On a Friday evening, a senior client-facing employee at a global digital advertising agency received a notice announcing that a data export was ready and that a document needed an electronic signature. The task line described a fiscal-year compensation and settlement NDA presented as an eSign task, carried a fabricated reference reading Ticket#1920FD, and warned that the link would be valid for only the next 24 hours. There was one button in the middle of the message.

That button carried four different destinations at once. Three of them contradicted each other, one was accurate, and the accurate one was the hover text, which is the field a careful reader is trained to check and the field an operator has the least reason to maintain.

Nothing in the message was provably attacker-registered: every domain, host and mailbox in it belonged to a legitimate vendor, a legitimate business, or somebody who had been robbed. The mail genuinely left a long-established software company's bulk-mail account, signed with that company's real key, so authentication reported a clean pass and handed the defender nothing to key on.

One Anchor, Four Destinations

Field one was the visible text. It had been hand-typed to read as a comma-separated export file sitting on the agency's own web domain, in the shape hxxps://VICTIM-DOMAIN/exports/submissions_export_UUID[.]csv. The agency publishes no such directory. A reader checking the string against the brand they trusted most, their own, would have found it reassuring.

Field two was the href, the value a click actually follows. It pointed at a bulk-mail click-tracking host belonging to the sending account, with a tracking payload appended. Nothing about it resembled the file named in field one.

Field three was an originalsrc attribute, which no author writes by hand. Certain mail clients add it when they rewrite a link during rendering, preserving the URL as it stood beforehand. It can only appear on a link some mail stack had already processed for a message already delivered to somebody. The URL it preserved was a form-backend vendor's genuine object-storage address for a customer's export file.

Field four was the title attribute, which surfaces as the tooltip on hover. It held a complete URL-rewrite wrapper of the kind a mail-security gateway produces, and inside it sat a link into a mortgage loan-origination portal's pending-task list. That wrapper is there because the link once passed through that gateway, on its way to a mailbox that was not this one.

The Only Honest Field in the Button

The tooltip was truthful by neglect, not by design. It was also incoherent with the pretext in front of it: an eSign request aimed at an advertising agency does not lead to a mortgage portal's task queue, and the wrapper around it belonged to an organization with no relationship to the recipient. This was never camouflage. Camouflage is built to match the story around it.

Then the corroboration that closes the question. The pasted sign-off in the body left behind a mortgage license number, and the same value appears as a numeric account segment inside the tooltip's URL. Two independent fields of one message agree on the identity of a stranger, which is the opposite of a legitimacy prop. It is self-incriminating residue: the button and the sign-off were lifted from the same already-delivered mail, and the operator never noticed that the two fragments named each other.

See Your Risk: Calculate how many threats your SEG is missing

The Seams in the Shell

The anchor was not the only place the collage showed. The pasted block still carried a receiving mail client's render-time debris: class names prefixed with x_, a data-auth attribute, and data-linkindex values of 0 and 2 with index 1 absent, consistent with a link deleted from the copied region. HTML authored from source does not contain the artifacts a mail client writes while displaying a received message.

The outer shell had a seam of its own. It was a form-backend vendor's real export-ready notification, kept almost intact down to the footer link with the vendor's own campaign parameters, its copyright line, and a logo hotlinked live from the vendor's content delivery network. The trailing paragraph still told the reader that if they had trouble clicking the "Download export" button, they should use the link below. The visible button said "View and complete tasks." A template substitution had also failed and emitted the recipient's address twice in the greeting.

The pasted material came from other people's mail and is treated here as evidence only; its contents are not reproduced.

Checking the Anchor Against Itself

Themis flagged the message at confidence 90 with the label Credential Theft, citing content and structure patterns, sender inconsistencies and community reputation from similar incidents, and the platform auto-resolved it as phishing. One mailbox was affected and no mitigation action was recorded. Notably, every link in the message scanned clean, so link reputation contributed nothing at all. When authentication passes, the sending business is real and reputation is silent, a message's own composition is the last surface left, and that is exactly the surface our Adaptive AI reads.

Two checks would have caught this with no reputation data whatsoever. The first is internal consistency: an anchor whose text, href, originalsrc and title describe four different destinations is a structural contradiction, mechanically detectable, and effectively impossible to produce by writing a link from scratch. Corroborating that, more cheaply than any sandbox, are the seams: instructions that describe a button the message does not contain, and a greeting the template failed to fill.

The pressure model was ordinary. The 2024 Verizon Data Breach Investigations Report puts the median time from opening a phishing message to clicking at 21 seconds, and 28 seconds to submit data, and finds phishing present in 15% of breaches. A link-expiry line exists to keep a reader inside that window rather than inspecting an anchor's attributes. Defending the gap means treating credential harvesting as a content problem rather than a link-reputation problem, and inspecting URL structure and behaviour rather than a domain's history. CISA's phishing guidance and the NIST definition of phishing both frame the technique as deception inside the message, which is precisely where this one lived.

Indicators of Compromise

MITRE ATT&CK Mapping

The lesson generalizes past this campaign. Authentication answers who handed a message to the internet, and reputation answers whether anyone has complained about a destination yet. Neither answers whether the message is internally coherent. Whether an anchor agrees with itself is a question a defender can ask of every message for free, and on a Friday evening it is sometimes the only question left with an answer.