The Invoice Portal Link That Didn't Need a Password

An invoice phishing campaign spoofing Ecocert delivered Mailgun-authenticated emails containing a tokenized JWT link to a real billing portal (app.upflow.io) that allowed anyone with the URL to view invoices without logging in; the message included a PDF with an IBAN for a 380 EUR payment and a 1x1 tracking pixel confirming mailbox activity — four mailboxes were quarantined and the attack was flagged by Themis.