One Extra Letter, Full Auth Pass, Nothing to Scan

A targeted BEC campaign impersonated a medical-device vendor using a one-character typosquat domain (arthrrex.com) that the attacker fully provisioned (SPF/DKIM/DMARC) to pass authentication checks; the email asked victims to reply with ACH banking details and included a backdated, scanner-clean PDF promising account information in an encrypted file with a PIN sent out-of-band. The message contained no malicious links or attachments, arrived as an in-thread reply to evade heuristics, and resulted in multiple mailboxes being quarantined; recommended mitigations include treating authentication passes as identity claims, running edit-distance checks against vendor domains, and verifying payment changes out-of-band.