The Security Vendor Hop Was on the Sender's Side

A spearphishing campaign targeted a French calibration company's CEO using a vendor-signed email that passed DKIM/DMARC and bypassed authentication-based defenses; the attack delivered a PDF containing a QR code that pointed to a credential-harvesting domain. The report details the mail path showing Trend Micro Email Security acted as the sender's outbound signer, lists IOCs (sender IP 213.210.58.38, lunwah.com, PDF MD5, DKIM selector), and recommends validating whether a vendor hop is inbound or outbound and treating pristine authentication from disposable domains as suspicious.