Three Hops Deep, Behind a Gate No Scanner Can Solve

The subject line was in capitals, REQUEST TO UPDATE FINANCIAL INFORMATION, and the message under it was polite and specific. It came from the credit manager at a regional HVAC distribution business, a supplier the recipients had been buying from for years, and it asked them to confirm their billing and remittance contacts. To do that, the reader was told to download the attached contact form, complete it, then follow a short sequence of steps to submit it.

Those steps are the attack. There is no malicious hyperlink here, only an itinerary written in ordinary business English, three hops long, ending at a page that asks the recipient to verify their email address.

Four mailboxes at the receiving organization, a consumer beverage manufacturer, got the same message, all of them in or beside the accounting function. One of the accountants reported it as suspected phishing, and within a day an analyst had approved quarantine across all four.

The Routing Lived in Prose, Not in a URL

Most credential funnels compress themselves into one hyperlink, which suits the defender as much as the attacker: a single link is a single object a scanner can resolve, follow and score. This campaign gave up that convenience deliberately, and the body walked the reader through the alternative: open the attached form, fill it in, go to the section labelled for progress, which redirects to a shared document page, click the control marked for uploading a file, open the upload portal that appears, complete the bot check, enter an email address, upload the completed form, then verify that email address through the portal to finish the submission.

Read as security telemetry, that paragraph is nothing. No domain to reputation-check, no redirect parameter to unwind, no encoded payload. Read as instructions, it is a complete attack chain whose only executor is the person holding the mouse. When the routing lives in language rather than in infrastructure, the artifact is grammar.

Hop One: A Form the Sandbox Could Not Open

The message carried two attachments. One was a large animated logo image, and a byte-level look confirmed exactly that. The other was a roughly 2.5 MB PDF named after the vendor, and it returned a clean verdict.

That verdict deserves a footnote, because the analysis behind it says so plainly. The automated attachment sandbox could not complete a deep extraction of the file. It recorded the failure, noted that a clean result does not rule out embedded form actions or redirects inside the document, and recommended the file only ever be opened in isolation. So hop one arrived with a green result that explicitly disclaims knowing what is inside it, and the record of that non-event does not travel with the file into the user's downloads folder.

Hop Two: A Redirect Into Genuine File-Sharing Infrastructure

From the form, the itinerary sends the reader to a shared document page on real, mainstream file-sharing infrastructure. This hop does no harm on its own, which is exactly why it is in the sequence: it launders the instructions. A recipient told to expect a shared page, who then sees one from a platform they use daily, has had the directions validated by their own environment.

It also breaks the chain into segments no single control owns end to end. The mail gateway saw clean attachments, and link protection had nothing malicious to rewrite. The upload control on the page is a click, not a header, and clicks are not inspected. That is the structural weakness that makes vendor email compromise productive: every individual element checks out.

See Your Risk: Calculate how many threats your SEG is missing

Hop Three: A Gate Built Specifically to Exclude Automation

The last hop is a Microsoft-branded upload portal, and the first thing it presents is a bot check.

A bot check is a test designed so that only a human can pass it. Point a crawler, sandbox or detonation service at it and it stops there, because stopping there is the whole specification of the control. Whatever the portal shows after the gate is never fetched, never rendered, never scored. The scanner returns the only thing it honestly can, a description of a gate, and downstream that reads as an absence of evidence of harm rather than an absence of inspection.

Be precise about the limit of what is known. No screenshot of the page behind that gate exists, and no successful extraction of the form's embedded actions exists either. What can be stated is what the email instructs, and it instructs the recipient to verify their email address through the portal as the final step. A verification prompt inside a Microsoft-branded page, arriving as the last click in a routine vendor form submission, is a credential harvesting ask in the only shape most people will ever accept one.

What the Form Was Actually Asking For

Strip away the funnel and look at the shopping list: accounts payable and receivable contacts, the addresses that receive remittance advices, updated billing details. That is the contact map needed to redirect future payments, harvested from the people who control them, with the credential ask bolted on at the end. The 2024 Verizon Data Breach Investigations Report puts stolen credentials in 38% of breaches as the most common initial action, and the 2023 FBI IC3 Internet Crime Report recorded roughly $2.9 billion in reported business email compromise losses. Contact maps like this one are how that number gets built.

Accounts payable was the correct target, too: it is the one function whose ordinary job is fielding unsolicited requests to change payment details from vendors it recognizes. The pretext does not have to overcome scepticism. It has to blend into a queue.

Why the Authentication Verdict Was Beside the Point

Every cryptographic check passed, sealed chain of custody included, because the mail genuinely left the vendor's own infrastructure from an apex domain registered more than two decades earlier. That establishes origin and nothing else, so treat the driver of that mailbox as unknown rather than assuming a mechanism. What made the message visible was behaviour: sender and recipient headers holding the same address, and a link protection artifact still carrying a second mailbox at the same vendor, which is what a template looks like after it has been mailed to a list. Our Adaptive AI scored it at 89% against a high-value recipient profile, with content, community and sender-behaviour signals all reporting bulk-send characteristics underneath the clean authentication.

Then an accountant read it, did not like being asked to solve a bot check in order to file a vendor form, and pressed report.

Where to Put the Control

Neither CISA guidance nor the NIST definition of this attack class depends on there being a bad link, and neither should your controls. Treat a clean verdict that arrives with an incomplete-inspection note as an unknown, not a pass. Treat a gate that excludes automation as a detection outcome in its own right, because a chain terminating exactly where the scanner stops was probably designed that way. And put the payment-detail change workflow out of reach of any form submission: out-of-band confirmation on a known number for every remittance or banking change, however clean the authentication.

The email was real, the vendor was real, the relationship was real, and the form was a funnel. Only the last of those four was ever something a scanner was going to tell you.

Indicators of Compromise

MITRE ATT&CK Mapping

For the domain policy mechanics that returned pass on this message, see RFC 7489.