The Email That Passed Every Security Check (Because Adobe Sent It)

A targeted spearphishing campaign leveraged Adobe's legitimate emailing and redirect services (Amazon SES-sent, DKIM/SPF/DMARC-validated adobe.com messages) to deliver personalized credential-harvesting lures to a K‑12 school district; links used postoffice.adobe.com with JWT-encoded destinations that appeared benign to URL scanners. IRONSCALES' semantic analysis and community telemetry flagged and quarantined the messages across four mailboxes before credentials were harvested, illustrating how "living-off-trusted-services" attacks bypass authentication- and reputation-based controls.