State Farm Spoof Rides a Compromised Law Firm

An insurance claims team received an email that every authentication check waved through. SPF passed. DKIM passed. DMARC passed. Microsoft composite authentication scored it 100 out of 100. The From line read "StateFarm Claims." And none of that brand was real.

The message was not spoofing the State Farm domain. It was riding a genuine, fully authenticated mailbox at a small law office, using nothing more than a display name to borrow a Fortune 50 insurer's credibility. The real work of the attack happened after the auth stack signed off.

The display name said State Farm, the Return-Path said law firm

Here is the anatomy. The From header rendered as "StateFarm Claims" with an address string of Statefarmclaims@statefarm[.]com sitting inside the display name field. To a claims adjuster scanning a busy inbox, that reads as State Farm. But the envelope sender, the actual Return-Path, was rkumar[@]rjklawoffice[.]com. That domain, rjklawoffice[.]com, is a real law-office domain registered through GoDaddy on 2020-06-19. It was not stood up last week to impersonate anyone.

The mail originated from the law office's own Microsoft 365 tenant. That is why SPF, DKIM, and DMARC all passed and compauth landed at 100. The sending infrastructure was legitimate. The signals security tools trust most were all telling the truth. The mailbox itself had been taken over, and a hijacked but genuine mailbox is the one thing an authentication-only defense cannot see. This is textbook account takeover turned into a delivery vehicle. The attacker did not need to forge State Farm. They needed to log in as a lawyer.

A ShareFile promise, a Smartsheet trap

The body did the social engineering. It told the recipient a "Claim Document" was waiting, instructed them to review and submit a release, and attached an artificial expiration deadline to manufacture urgency. Deadline pressure is a staple of these operations for a reason. The 2024 Verizon Data Breach Investigations Report found the median time to click a phishing link is 21 seconds and to submit data just 28 seconds, so attackers who compress the decision window win.

Then the template made a mistake. The body stated that State Farm "uses ShareFile to share documents securely." The only actionable link in the entire message pointed to Smartsheet. ShareFile and Smartsheet are two different products from two different vendors. That contradiction is a tell that the kit was assembled from reused parts, that the sender never noticed the mismatch, and that no real State Farm workflow was ever involved.

The link resolved to hxxps://app[.]smartsheet[.]com, a legitimate third-party host. The form living at that address was the trap. Because Smartsheet is a trusted business platform, URL reputation scanners return a clean host verdict. They are evaluating the domain, not the intent of the specific form, and that form was built to collect claim details and personal data. Abusing trusted software-as-a-service to host the collection page is now standard practice, and it neuters any control that stops at domain reputation.

This was not a one-off. The same lure hit at least four mailboxes across two separate organizations over a three-day window, each independently quarantined. That is a persistent campaign working a vertical, not a spray.

Why the auth stack gave it a clean bill of health

Every layer that most email security leans on failed silently here, and none of them malfunctioned. They did exactly what they were designed to do. SPF, DKIM, and DMARC verify that a message came from where it claims to come from at the domain level. This message genuinely came from rjklawoffice[.]com, so it passed. Composite authentication agreed. The URL scanner checked app.smartsheet[.]com, found a real and non-malicious host, and passed it too.

The compromised asset was the mailbox, not the domain. That is the blind spot. When the sending infrastructure legitimately belongs to an abused third party, a scenario closely related to vendor email compromise (VEC), authentication is not a control. It is a rubber stamp. IRONSCALES platform data shows secure email gateways (SEGs) miss an average of 67.5 phishing emails per 100 mailboxes each month, and messages like this one are exactly why. The gateway is hunting for forgery, and there is no forgery to find.

Our Adaptive AI caught it on the signals authentication ignores. Themis flagged the brand-versus-domain mismatch (a State Farm display name over a law-office Return-Path), the internal ShareFile-to-Smartsheet contradiction, and the combination of a data-collection form aimed at a recipient in a role attackers prize. Content and behavior, not headers. The 2024 Verizon report also puts the human element in 68% of breaches and stolen credentials in 38% of them, which is precisely where an attack like this is trying to take you.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

How this maps to MITRE ATT&CK

The attack chains three techniques. T1656 Impersonation covers the State Farm display-name masquerade. T1586.002 Compromise Accounts: Email Accounts describes the hijacked law-office mailbox used to send authenticated mail. T1566.002 Spearphishing Link is the Smartsheet form delivered as the payload.

CISA phishing guidance makes the same point in plain language: technical controls alone will not stop a well-crafted lure, which is why reporting and human-layer defenses matter. The Microsoft Digital Defense Report 2024 documented the same shift toward identity and account abuse over malware. This case is where those trends meet a single inbox.

Trust the content, not just the credentials

The lesson is narrow and actionable. Authentication tells you a message is genuinely from a domain. It tells you nothing about whether that domain's mailbox has been hijacked, or whether the brand in the display name matches the address behind it. Build detection that reads a message the way a suspicious human would. Does the sender domain match the brand it invokes. Do the stated tools match the actual links. Is the ask, in this case submit a release and beat a deadline, consistent with how the real company operates. When those checks live in the platform instead of the recipient's gut, the compromised-third-party attack stops being invisible. IRONSCALES protects 35,000+ security professionals across 17,000+ organizations against exactly this pattern, using CISA phishing guidance as a shared baseline for what good looks like.