The $15,247 Invoice That Came With Its Own W-9

A sophisticated invoice-phishing/payment diversion campaign targeted an energy company's accounts payable, delivering a fully fleshed vendor package (invoice, memo, W-9) from the newly-registered domain globaltradeaudit.org via Amazon SES, embedding an AWS-hosted tracking pixel to confirm opens and instructing wire payment to a fraudulent beneficiary (Synza, Inc.). The report lists IOCs (sending domain, sender address, SES IP, PDF MD5s, tracking domain), highlights operational cues (no DMARC, non-PO invoice, weekend timing), and recommends out-of-band vendor verification, EIN cross-checks, flagging external non-PO invoices, and behavioral email security.