The Vendor Thread That Bit Back: How a Legitimate Tunneling Service Became a Phishing Vector

A vendor conversation thread was weaponized to deliver a malicious tunneling subdomain (a.pinggy.io) that passed SPF/DKIM/DMARC and attempted credential harvesting; the malicious link was tied to sandboxed PowerShell artifacts and an access token was exposed in the quoted history. IRONSCALES' Adaptive AI (Themis) detected link behavior, community signals, and content-context anomalies and quarantined the message across affected mailboxes within seconds; the report includes IOCs and recommended mitigations (audit tunneling services, revoke exposed tokens, deploy content-aware detection).