The Attachment Card That Printed Its Own Emptiness

The subject line came in as a vendor payment reference, and it misspelled the word reference. That was the only visible flaw. Everything else was correct: a familiar vendor contact in the from field, a plausible remittance pretext, and an attachment sitting right there under the body text with a document icon and a filename that read like a payment record. The message reached a shared collections and accounts-receivable intake queue at a national in-home senior care services provider, forwarded there from an individual mailbox that had received it first, which is how remittance traffic normally arrives at a functional queue. Nobody in that queue had a reason to treat it as unusual.

The attachment was a drawing.

Zero Bytes, Stated By the Forgery Itself

What sat below the body was not a file. It was HTML built to imitate the widget a mail client draws around an attachment: a bordered panel, a document glyph, a payment-reference PDF name, and beneath it a size label. The label read 0 bytes.

That is a forgery that reports its own emptiness. Attachment analysis had nothing to examine because nothing had been attached, and the header that records attachment presence came through blank. Both facts were available at inspection time, before anyone resolved a link, and both contradicted the picture the recipient was looking at. The card was never meant to survive scrutiny. It existed so that a large blue download button would read as the natural way to open a document that had already arrived.

The filename is worth describing rather than reproducing. It jammed a payment reference number, a street address, a bulk-set descriptor and an expiry date into one string: the shape of a name generated by a template rather than saved by a person, with a third-party address fragment inside it that should never be republished. The body echoed the same expiry idea in prose, framing the download as available only for a short window. A deadline is cheap to assert, and it does what urgency always does, which is make checking feel more expensive than clicking.

The Sending Domain Was Real, and Its Policy Was Enforced

The reflex on seeing a fake attachment card is to expect throwaway sending infrastructure behind it. This case inverts that. The vendor's apex domain was registered in 2006 and had been in continuous use for nearly eighteen years. It signs outbound mail with its own published key and publishes a DMARC policy of reject for the apex and reject for subdomains, the strictest posture the specification offers. The message satisfied it: DKIM validated against the vendor's own selector, the header from address aligned, DMARC passed cleanly.

None of that was a bypass. The mailbox belonged to the vendor, the domain belonged to the vendor, and the operator sending the message was inside both. RFC 7489 describes a mechanism for proving that a message originated from the domain it claims. It says nothing about whether the human at the keyboard is authorized, and a takeover does not evade the identity layer so much as inherit it. Eighteen years of sending reputation transferred to the lure intact. This is why account takeover is the compromise that most reliably defeats authentication-first filtering: there is nothing left to fail.

See Your Risk: Calculate how many threats your SEG is missing

One Hop Softfailed, and That Was Not the Attack

The received chain holds a detail that is easy to misread. At the earliest recorded hop, the vendor's own cloud mail platform logged an SPF pass for the sender. At a later hop, a consumer webmail relay logged an SPF softfail for the same address, with the usual note that the sending domain does not designate that relay.

Read in isolation, a softfail on a phishing message looks like the smoking gun. It is not. The message originated inside the vendor's own mail system, then travelled onward through relay infrastructure the vendor's SPF record was never going to authorize, and the signature and alignment held the whole way. Spoofing at the origin produces the opposite pattern, authentication that degrades as the message moves toward the recipient, rather than authentication that stays valid while one intermediate envelope check disagrees. The discriminating question is whether the message authenticated at its earliest hop, before any forwarder touched it. Here it did.

A Free Subdomain With No History to Grade

The download button resolved to a single destination: a subdomain on a free serverless application platform. That is why the link had no reputation problem. The name sat under a shared apex used by an enormous population of legitimate applications, so it had no registration date of its own, no ownership record, and no history for a domain-age heuristic to score. Blocking the apex outright is not available to most organizations, because it breaks real tooling that lives there.

The attacker also built the vendor's brand into the subdomain label, so the hostname read as a payment portal belonging to the company whose mailbox had been taken over. That is why the hostname is masked here alongside the mailbox: the label leaks a compromised bystander's identity as effectively as the sender address does.

The Gate That Answers Machines With a Waiting Room

Fetching the URL returned a normal response with no redirect. What it served was not a login form. It was a verification interstitial demanding a sustained press-and-hold gesture to prove the visitor was human.

That is a deliberate choice against automation. A crawler, sandbox or link scanner following the button reaches the gate, cannot satisfy a gesture requirement, and retrieves nothing beyond the waiting room. Whatever the page serves a person who clears it is never observed, leaving content-based scoring almost nothing to grade. Automated risk scoring still rated the destination high, at 0.80, with a recommendation to block, but that verdict rests on the shape of the infrastructure rather than anything the page displayed. The 2024 Verizon Data Breach Investigations Report puts the median time to click a phishing link at 21 seconds. A gate that stalls a scanner indefinitely costs a motivated human under a second.

What Actually Flagged It

The verdict came from neither the link nor the attachment, because one was unobservable and the other did not exist. Themis, the Adaptive AI analyst, scored the message as credential theft at 83 percent confidence, drawing on the message as a whole and on community reputation signals from similar prior incidents. The platform resolved the incident automatically as phishing. The record shows a single affected mailbox with no mitigation action logged at capture time, which is the recorded state rather than a decision.

The composite carries the judgment. A promised file absent from the headers, a payment pretext arriving at a functional queue by internal forward, a short artificial deadline, and a link whose only observable behaviour is refusing to be observed. Each is weak alone. Together they describe credential harvesting accurately enough to act on, and none of them require the sender to have failed a single authentication check. Both the CISA phishing guidance and the NIST definition of phishing frame the problem around the deception rather than the transport, and the 2023 FBI IC3 Internet Crime Report put reported business email compromise losses near 2.9 billion dollars, redirected through queues exactly like this one.

The practical control is a habit. When a message says a document is attached, confirm the document exists before confirming anything about the sender. A file that renders as a picture of a file, and reports its size as nothing, has already told you what it is.

Indicators of Compromise

MITRE ATT&CK Mapping