One Extra Letter, Full Auth Pass, Nothing to Scan

An accounts-payable notice reached a large U.S. regional healthcare system announcing that a medical-device manufacturer it already bought from was ending check and credit-card payments and moving everything to ACH. The message passed SPF. It passed DKIM. It passed DMARC. Microsoft's composite authentication returned a full pass with reason code 100, and the ARC chain preserved that verdict intact across both handoffs on the way in. Every hyperlink in the message resolved to the manufacturer's genuine website and social channels, and all of them scanned clean. The attached PDF carried no JavaScript, no form fields and no embedded executable, and it hashed clean too.

The sending domain was arthrrex[.]com. The manufacturer's real domain is arthrex[.]com. The difference is a doubled r, sitting in the middle of a word most accounts-payable clerks have never had reason to spell.

The Doubled R Was the Only Thing Wrong With the Sender

The legitimate domain has been registered since December 1997 through a registrar that predates most of the internet, on nameservers it has held for years. The lookalike went up in mid-February 2026 through a mass-market registrar, parked on that registrar's default DNS. One character of edit distance, twenty-eight years of registration history apart.

Everything downstream of that registration was done properly. The attacker published an SPF record that authorized the commercial relay they had bought sending capacity on, so SPF passed against the envelope sender. They configured DKIM signing, so the signature verified under the sending domain's own key. They published a DMARC record, and because the visible sender aligned with both the envelope and the signature, DMARC passed as well.

Worth being precise about what that pass means. Under RFC 9989, a DMARC pass is a statement that the message is aligned and authenticated, nothing more. The attacker's published policy was quarantine rather than reject, so the pass came from alignment holding, not from an aggressive posture they had adopted to look serious. Three green checks in a row, and all three of them are true. They certify that whoever operates arthrrex[.]com sent this mail. That was never in doubt, and it was exactly the problem.

The Memo Was Manufactured the Day the Domain Was, Then Backdated

The attachment was a PDF styled as an executive memo, presented as an internal notice that had been forwarded outward to customers. It was signed by a president of the manufacturer, a persona that does not exist, and its distribution list was a row of other mailboxes on the same lookalike domain, several more fabricated recipients invented to make the forward look like it had circulated internally first.

Parsing the file directly rather than trusting the narrative around it produced the detail that dates the whole operation. The PDF's own creation and modification timestamps, written by Microsoft Word, land on the same calendar day the lookalike domain was registered, at a quarter past three in the afternoon. The date printed inside the memo's text reads three days earlier.

So the sequence is not a compromised vendor forwarding an authentic notice. The infrastructure and the document were built together in a single afternoon, and the document was then given a date three days in the past so it would read as something already in motion. The memo's stated pretext is the standard one, in the attacker's own wording: the manufacturer had "recently learned that we have several unhonored checks," would "no longer accept checks and credit card payments," and needed all payments routed "through ACH to our subsidiary company that's domiciled in another name." That last clause is doing real work. It pre-explains why the account about to be nominated will not carry the vendor's name.

Nothing Actionable Was Ever Placed Where a Gateway Could Read It

The email's instruction was to write back. The exact ask, "please email apinquiry@arthrrex[.]com with your banking detail or for further information," sits in the HTML body as plain text with no anchor tag wrapped around it. It is not a link and was never meant to be one. The links that were present padded the signature block with the real manufacturer's real properties, which is why link analysis returned clean verdicts across the board.

The PDF then closes the other half of the loop. Its operative line, verbatim, is that "the subsidiary ACH information is sent as an encrypted file and a pin to that file has been sent separately to you all." No account number appears in the email. None appears in the attachment. The routing detail that would make this fraud actionable was promised on a channel that does not exist yet, gated behind a PIN promised on a third one. There is no URL to reputation-check, no attachment to detonate, and no bank detail to pattern-match, because the attacker put none of it in the mail path.

This is the structure NIST describes when it defines phishing by deception rather than by payload. It combines attachment-based delivery, tracked by MITRE ATT&CK as spearphishing attachment, with infrastructure the adversary stood up in advance under MITRE ATT&CK and brand impersonation of a real supplier. The 2026 Verizon Data Breach Investigations Report now tracks pretexting separately as 6 percent of initial access vectors, alongside the 62 percent of breaches that involve a human element, and the money follows: the 2025 FBI IC3 Annual Report puts business email compromise losses at $3,046,598,558.

See Your Risk: Calculate how many threats your SEG is missing

One more thing suppressed the obvious heuristic. This message was not cold contact. It arrived as a reply inside an existing thread, carrying a valid in-reply-to reference, and the platform recorded the sender as not a first-time sender to that organization. Controls that weight first contact from an unknown domain had already been quieted before anyone read a word of it.

What the Adaptive AI Had Left to Weigh

Strip out authentication failure, malicious URLs, hostile attachments and first-contact novelty, and very little remains. Themis, the IRONSCALES Adaptive AI analyst, scored the message at 84 percent confidence, and the reasoning it recorded was blunt: the return-path domain was newly registered, a pattern typically associated with suspicious activity. Domain age was the lever, because domain age was the only clean signal the attacker had not controlled. Four mailboxes across two waves in mid-July were quarantined and mitigated, and the incident auto-resolved as phishing.

What To Change After a Case Like This

Three adjustments generalize past this one message. Treat a full authentication pass as an identity claim rather than a verdict, since business email compromise increasingly arrives from domains the attacker owns outright rather than ones they had to break into. Run edit-distance scoring against your own vendor master list, because a one-character variant of a domain you already pay is a far stronger signal than a newly registered domain in isolation. And make any change to payment instructions unverifiable by email, on principle, which is the practical form of the CISA phishing guidance: confirm on a number from the contract, not a number from the request.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

Authentication told the truth about this message and the truth was useless. Check back tomorrow.