The Verified FedEx Email That Wanted Your Documents

Most phishing analysis starts by finding the flaw in the authentication. This message did not have one. It passed SPF. It passed DKIM, with the signature cryptographically verified against a genuine fedex.com key. It passed DMARC under a strict p=reject policy. The Microsoft 365 edge scored it compauth=pass reason=100, the cleanest verdict the platform issues. By every server-level measure, this was a real FedEx email.

It was also an attack. And it never touched a password field.

The message landed in several mailboxes at a multinational flavor, fragrance, and color-ingredient manufacturer with heavy Asia-Pacific supply chain operations. It carried a Chinese-language customs-clearance pretext, a tracking number in the subject, and a set of FedEx-branded spreadsheets. What it wanted was not credentials and not a wire transfer. It wanted the company's paperwork.

A Clean Auth Verdict Is a Pipe, Not a Promise

Authentication answers one narrow question: did this message travel through infrastructure allowed to send for the claimed domain, without being altered? Here the answer was yes. The sending IP 205.220.179.9 was authorized for fedex.com, SPF passed, and the DKIM signature for header.d=fedex.com verified cleanly. There was a second DKIM signature for myfedex.onmicrosoft.com that failed, but that domain was never the alignment target, so it had no effect on the DMARC result. DMARC aligned to fedex.com under p=reject and passed.

That verdict tells you the mail path was genuine. It tells you nothing about the person operating it. A first-time sender riding a legitimately authenticated brand path is the exact scenario that a reject policy was never designed to catch, because nothing was forged. This is why authentication, on its own, keeps teaching the same lesson: SPF, DKIM, and DMARC validate the envelope, not the intent behind it.

Threaded Into a Conversation That Was Already Trusted

The attacker did not fire a cold blast. The message carried In-Reply-To and References headers that slotted it into a long-running Outlook conversation involving multiple employees. To Outlook, and to the humans reading it, the note appeared as the next reply in a thread they already trusted. Inherited legitimacy did the heavy lifting that a spoofed header could not.

Against that backdrop, the only real tells were quiet ones. The sender was a first-time correspondent despite the trusted thread. The greeting was generic where a genuine ongoing exchange would name the recipient. And the signature block cited a Guangzhou phone number, a street address, and a customs registration code, none of which resolve to any independently confirmable FedEx China asset. They read as real. They are not verifiable. That gap is the point.

See Your Risk: Calculate how many threats your SEG is missing

The Ask Was Documents, and That Is the Tradecraft

The body demanded that recipients supply their import and export paperwork: the underlying contract, the commercial invoice, the packing list, and a customs clearance confirmation. It framed the request with a short deadline and a threat of storage fees and penalties if the goods were not cleared in time. Attached were plausible FedEx-branded templates, an XLSX customs-confirmation form, an XLS contract and invoice template, and an image-only PDF built around the tracking number. All three scanned clean. No macros, no embedded exploit, no credential-harvesting page. The attachments referenced only a legitimate third-party HS tariff-code lookup site, which is not malicious.

That absence of a payload is not sloppiness. It is the design. When the goal is to elicit documents, there is no reason to attach malware or stand up a fake login portal that a scanner might flag. Trade paperwork is a reconnaissance prize. Contracts reveal vendor relationships and payment terms. Invoices reveal amounts and banking rhythms. That is precisely the fuel for a later invoice-diversion or vendor email compromise attack, and it is far more valuable than a single harvested password.

Mapping to MITRE ATT&CK

The behavior lines up with a few techniques in the MITRE ATT&CK framework:

• T1598 Phishing for Information is the core of it. The objective was to collect sensitive business documents rather than credentials or an immediate payment.
• T1585 Establish Accounts covers the first-time-sender identity operating on the authenticated brand path.
• T1656 Impersonation covers posing as a FedEx customs function the sender has no confirmable authority to represent.

Indicators of Compromise

Detection When Every Header Checks Out

Signature and reputation engines had no purchase here. The infrastructure was authentic, the auth was clean, and the attachments were benign. Detection has to move to behavior and relationship context. The signals that mattered were a first-time sender arriving inside a trusted thread, a greeting too generic for an established exchange, a sudden pretext and language shift, unverifiable contact details in the signature, and a document request wrapped in a deadline and a penalty threat.

This is the layer static gateways miss. Themis, the Adaptive AI analyst on the IRONSCALES platform, reads the relationship between the claimed brand, the sender's history with the organization, and the intent of the request, flagging the anomaly even when SPF, DKIM, and DMARC all come back green. The 2024 Verizon Data Breach Investigations Report (DBIR) puts the human element in 68 percent of breaches and names pretexting, largely business email compromise, as the top social-engineering incident type. The Microsoft Digital Defense Report 2024 documents the same drift toward abusing trusted services rather than breaking them, and the FBI's 2023 Internet Crime Report ranks business-identity impersonation among the costliest fraud categories. Across 35,000 security professionals at more than 17,000 organizations, the pattern IRONSCALES sees is consistent: the strongest attacks now pass authentication, not fail it.

The Takeaway

A verified sender is a starting point for scrutiny, not the end of it. When a message clears every authentication check and still asks you to email out your contracts and invoices, the auth result is a distraction, not a defense. Manufacturers with cross-border supply chains are squarely in scope for this play, which is why manufacturing email security has to weigh who is really asking and what they want, not just whether the envelope was signed correctly. CISA's guidance on recognizing and stopping phishing early is a solid reference for building that reflex across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one