One Dell Order, Two Companies, One Signature

A real Dell order acknowledgement was weaponised: attacker-controlled Microsoft 365 tenants submitted orders that Dell legitimately rendered and signed, then relayed the identical signed message through different second-hop tenants to multiple unrelated organisations. Because the vendor signature and headers remained intact, standard authentication (DKIM/DMARC/SPF) validated the message despite the signed recipient field revealing the message was not intended for the recipient; the only actionable content was a phone number embedded in address fields (callback phishing).