Funding Agreement, Forged Approval: How a Three-Layer Redirect Chain Targeted Finance Leadership

A targeted spearphishing campaign impersonated a funding-agreement document notification to a VP of Finance, delivered via Amazon SES and concealed behind a three-hop redirect chain (Cisco Secure Web → compromised Argentinian redirector → haystack.so credential page). Authentication checks showed SPF passing for the SES relay but DKIM and DMARC failing for the claimed sender; IRONSCALES Adaptive AI quarantined the message seconds after delivery. Key IOCs include elettro-coltura.com, 54.240.3.30, waterpowerinn.com.ar, and 4creeks.haystack.so; recommended actions are enforce DMARC reject/quarantine, treat display/href mismatches as high-confidence, audit SES configurations, and add behavioral AI detection.