The Tracking Parameter That Named the Wrong Company

A message landed in a director-level mailbox at a mid-size forensic engineering and investigative consulting firm in late July 2026. The subject line was one word, "Notification". The body was a fabricated Microsoft Teams audio-message notification with a reference string, a purported internal caller, and a single button labeled Listen to Message.

The button is not the interesting part. Buried four layers deep inside that button's destination, past two rounds of encoding, was a leftover tracking parameter that named an employee address at a completely different company. Nobody was ever supposed to read it. It is the closest thing to a serial number a phishing kit leaves behind.

The parameter that did not belong

The button's destination was not a link to a login page. It was a container holding another container.

The outer hop was a secure-link redirector operated by an email-security vendor. Its query string carried a base64url-encoded object, and inside that object sat a second vendor's threat-scanning endpoint. That endpoint's own parameters carried a URL-encoded third hop, a link-shield redirect run by a third vendor. And that redirect's parameters held the final destination, encoded a second time: a payment-themed path on the apex domain of a Brazilian law firm that has held that registration since 2004.

Sitting immediately beside the final destination in that third hop was a recipient-tracking parameter of the form r=(local-part)@(organization)[.]com. It named an employee address at an organization with no relationship to the recipient, no relationship to the sending domain, no relationship to Microsoft, and no relationship to the landing domain. Parameters like that exist so a redirect service can report who clicked. This one had simply never been updated. It still identified whoever the template was aimed at the last time it ran.

Be precise about what that establishes. It does not mean the organization named in the parameter was breached, attacked, or involved. It means the redirect and tracking scaffolding in this message was assembled for a different target, then shipped again without being cleaned. That is kit reuse, evidenced from inside the message itself rather than inferred from a family resemblance across cases.

What the wrapper chain actually proves

Three separate email-security vendors appear in the decoded chain, and the instinct that follows is a trap. A recognized vendor hostname in a URL does not mean the URL was vetted by that vendor. It means the URL was formatted to transit that service.

Here the platform's link analysis reached the visible wrapper hops and returned two Clean verdicts and one Mixed Result. Nothing in the record independently scanned the final destination, several layers further down. So the honest statement is that the platform classified the message as credential theft on behavioral grounds, and that the landing page's actual behavior was never confirmed. Anyone claiming otherwise is filling in a gap the evidence does not close.

Read the chain as plumbing instead of as scrutiny and it becomes useful. Reused plumbing is stable. The nesting order, the encoding pattern, and the leftover identifiers carry forward between campaigns even when the domains rotate, which makes them a better hunting surface than any single hostname in the message. CISA phishing guidance makes the same structural argument: defenses that key on individual indicators lose to attackers who swap them cheaply.

Hidden junk inside the brand text

The lure carried a second, independent fingerprint. A single CSS class collapsed a span to zero width and zero maximum height, with hidden overflow, zero font size, transparent color, and Outlook-specific hiding applied on top. The kit then spliced that span inside the brand words themselves. Short hex-like fragments were injected into the middle of Microsoft and into audio message, and a literal zero-width space (U+200B) was dropped inside Teams.

A human reads clean brand names. A filter reading raw text sees the brand fractured across invisible junk, so literal keyword and template matching fails. That maps to Obfuscated Files or Information, and the class name itself is the durable artifact: it was authored once, and it travels with every copy of the kit.

See Your Risk: Calculate how many threats your SEG is missing

Authentication that passed on borrowed infrastructure

SPF passed. The sending IP was authorized in the envelope-from domain's SPF record. DKIM was absent, the message was unsigned, and DMARC returned a best-guess pass with no action. Composite authentication passed.

None of that describes attacker-owned infrastructure. The envelope-from domain belongs to a Japanese company that has been registered for roughly 25 years, and the delivery path ran through a Japanese shared hosting provider's outbound relay. The incident record does not settle whether a mailbox at that company was compromised or whether its published SPF record simply authorizes a shared relay that any tenant on that platform could send through, and it should not be asserted either way. What matters operationally is that the domain is a bystander in both readings, so blocking it penalizes a legitimate business and costs the attacker nothing. The same applies to the law firm whose site hosts the final path, and to the organization named in the stale tracking parameter.

The behavioral signals were the ones that held. This was a first-time sender with no prior correspondence in either direction, and the body was padded below the Teams lure with an entire unrelated legitimate business thread, years old and lifted from somewhere else, which is a volume trick rather than a credibility one. The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches, phishing as the initial access vector in 16%, and credentials somewhere in the kill chain in 39%, which is why credential harvesting remains the objective even when every technical check on the envelope comes back green. Authentication answers who was permitted to send. NIST defines the attack by its deception, not its transport.

What flagged it, and what happened next

Themis scored the message at 82% confidence and applied two labels, credential theft and VIP recipient, the second because the target was a director-level mailbox. It called out the Listen to Message link specifically as malicious, and the platform resolved the report as phishing automatically.

Then the campaign kept going. Over the following week, four more mailboxes at the same firm received the same template, and each was quarantined automatically within seconds of delivery. Reaching a decision on the pattern once, then applying it across the tenant without waiting for five separate analyst reviews, is the part that scales. That is what our Adaptive AI is for, and it is the same reason credential harvesting protection has to score sender behavior and message structure rather than trusting a hostname in a rewritten link.

Hunting reused kits instead of reused domains

Decode redirect chains all the way down, not to the first vendor hostname you recognize. Then read the leftovers. A tracking identifier that names an unrelated organization is not noise, it is a pivot, and it tells you the template predates this campaign and will outlive it. Hunt the hiding CSS class, the injected fragments, and the nesting order, because the attacker will change domains long before rewriting the kit. And when the sending domain and the landing domain both turn out to belong to real businesses, resist the block list. The infrastructure here was borrowed. The only thing the attacker actually owned was the template, and the template is what left a fingerprint.

Indicators of Compromise

MITRE ATT&CK mapping