Hackers Exploit Legitimate Apple and PayPal Invoice Emails in DKIM Replay Attacks

The report details DKIM replay attacks in which fraudsters create legitimate vendor invoices or dispute notifications (e.g., PayPal, App Store) that receive valid DKIM signatures, then forward those signed emails to many victims containing fraudulent support phone numbers in seller notes; because the messages are legitimately signed, they bypass DMARC/DMARC-aligned filters and land in inboxes, enabling large-scale financial social-engineering fraud. The article describes the attack mechanics, shows examples, cites Kaseya analysts' findings, and recommends defensive measures such as inspecting the envelope recipient versus the visible "To" header and verifying invoices via official portals rather than following contact details in emails.