Two-Stage Bank Scam Splits the Link to Starve Scanners

The most dangerous part of this attack was the part that never arrived. A supplier employee in a customer-service role opened a routine-looking request to update banking details, and the message told her, in plain language, that the link she needed would show up in a second, separate email. That single sentence is the whole game. By promising the payload later, the attacker guaranteed that no scanner would ever see the lure and the link in the same place at the same time.

This is split-delivery phishing, and it is a deliberate answer to how legacy gateways work. A secure email gateway scores each message on its own: it detonates attachments, it follows and reputationally checks URLs, it looks for a payload to condemn. Give it a message with no link and no attachment, and there is nothing to detonate. The recipient's legacy gateway did exactly what it was built to do and scored this one clean, with a phishing score of zero. It was not broken. It was starved.

Fully authenticated, because it really came from ServiceNow

The second reason this message sailed through is that it was genuinely well authenticated. It transited ServiceNow's own outbound mail infrastructure (outbound04.service-now[.]com, 149.96.195[.]2) from the mailbox sgsnow@service-now[.]com. SPF passed. DMARC passed. Microsoft returned compauth=pass reason=100. There was no spoofing to catch, because there was no spoofing. The mail really did leave a legitimate ServiceNow instance.

That is the uncomfortable core of legitimate-infrastructure abuse. When an attacker relays through a platform with a strict, well-published authentication posture, the mail inherits reputation and passes alignment checks that a throwaway domain never could. The From display name read like the beverage company's service desk, while the envelope domain was service-now.com, not the brand the message claimed to represent. To an alignment engine, that is a non-event: the message is authentic to service-now.com, and service-now.com passes. The mismatch between authenticated sender and claimed identity is only meaningful to something that reads intent, not headers.

The pretext: a procurement desk that wants your IBAN

The display name and signature impersonated a global beverage company's outsourced procurement desk, complete with a ticket-style subject, a supplier reference, and named contacts on Cc for texture. The ask was specific and expensive: provide a bank certificate or statement, no older than twelve months, showing the account holder name, account number, SWIFT code, and IBAN. Then watch for a follow-up email with a link to confirm the change in the vendor portal.

Read the sequence and the fraud is obvious. Message one harvests the real, current banking documents directly from the supplier, in the supplier's own words, on the supplier's own letterhead. Message two, the deferred link, is where credentials or a payment redirect get captured. Neither message is complete without the other, and that is the point. This is vendor email compromise engineered around the scanner's blind spot, and it fits the broader pattern the FBI IC3 2024 report tracks in its business-email-compromise complaints, where payment and vendor-account manipulation drive some of the highest per-incident losses of any category.

See Your Risk: Calculate how many threats your SEG is missing

Mapping the mechanics

On MITRE ATT&CK, the message is a clean phishing attempt with a deferred spearphishing link held back for the second stage. The procurement-desk persona is textbook impersonation, and riding a real ServiceNow mailbox to look like an expected internal-workflow notification is masquerading at the infrastructure level. No single technique here is novel. The engineering is in the ordering, splitting one attack into two innocuous-looking halves so the automated layer never assembles the whole.

The Verizon DBIR 2026 is blunt about why this style pays off: 62% of breaches involve the human element, and 16% use phishing for initial access. When the technical payload is deferred out of view, the human is the entire attack surface for the first message. There is nothing else to catch it.

Behavioral detection is the only detection

With no URL and no file to analyze, payload-based defense had nothing to work with. What flagged this message was the shape of it. Themis, our Adaptive AI, scored the email as credential theft on behavioral signals rather than payload signatures: a first-time external sender, a procurement identity arriving from an unrelated ServiceNow mailbox, a high-value request for financial documents, and the explicit instruction to expect a link in a separate email. The message was delivered at 14:52 UTC and quarantined roughly an hour later, before the promised second stage could arrive. According to IRONSCALES platform data, legacy gateways miss around 67.5 phishing emails per 100 mailboxes each month, and the ones that carry no payload are exactly the ones that slip.

For defenders, the takeaways are practical. Treat any email that promises a link, an attachment, or an action in a "separate message" as a split-delivery flag in its own right. Route bank-detail changes through an out-of-band verification channel, never through the email that requests them, per CISA phishing guidance. And do not let authentication results stand in for trust: a message can pass SPF, DKIM, and DMARC and still be a fraud, because passing means the mail is authentic to its sending domain, not that its intent is honest. Layered defense against business email compromise protection has to read the request, not just the headers.

Indicators of Compromise

See you next Friday.