Hackers Abuse Apple & PayPal Invoice Emails in DKIM Replay Attack Campaign

The report documents DKIM replay attacks in which attackers abuse user-supplied fields on trusted services (Apple, PayPal, DocuSign, HelloSign) to embed scam instructions into legitimately signed emails; those emails are then forwarded to victims and pass DKIM/DMARC checks, enabling convincing phishing, payment fraud, and remote-access malware installation. INKY researchers observed real campaigns and recommend inspecting headers for forwarding, being wary of phone numbers in messages, educating users, and validating notifications via official sites.