Your Own Mailing List Signed the Phishing Email

A credential-harvesting phishing message was externally posted to a Google Workspace accounting distribution group, which rewrote the envelope and applied the tenant's DKIM signature and ARC seals, making the externally-originated message appear internally signed; the CTA used a shared click tracker that redirected to a compromised WordPress admin path, and four mailboxes received the lure within a single second. Remediation: restrict external postings to distribution groups and treat internally-signed messages whose From header points to an external domain as suspicious.