Authenticated at Delivery, Forged at Origin

A high-severity spearphishing campaign used an eSignature-themed lure that failed SPF/DMARC at origin but was “laundered” via mailbox auto-forwarding and ARC to appear authenticated at delivery; the CTA routed through a Google open-redirect and ad-click layer to an aged decoy domain (ruslanstudio.com) that harvested credentials. The report includes IOCs (origin IP 188.215.229.105, redirect chain, subject line) and recommends reading full Received chains, treating trusted-domain redirects as suspect, and not relying solely on domain age or final DMARC stamps.