The Quoted Thread Still Had Open Grammar Flags In It

An analysis of a January 2026 Business Email Compromise targeting a small consumer services business: attackers delivered a three-line ACH payment instruction atop a quoted invoice thread that contained live authoring/editor markup, indicating the quoted block had been handled in the attacker's composition surface. All standard email authentication checks passed because the attacker controlled the sending domain and provider account; the report includes IOCs (attacker email and domains, tracking URLs, provider bounce address and IP), MITRE mappings, and practical detection and mitigation guidance to hunt for editor-specific attributes in quoted HTML and to verify payment changes out-of-band.