Your Own MX Signed the Phish. Then DKIM Failed.

A high-severity credential-phishing campaign impersonating "Meta for Business" reached a South African motor-dealership group through a legacy cPanel/Exim host that forwarded mail into Microsoft 365 and applied a DKIM signature in the dealership's own domain; the signature later failed verification, causing delivered headers to incorrectly attribute the failure to the victim's domain. The report analyzes the multi-hop mail path, gateway verdict discrepancies, attacker infrastructure (Cloudflare Workers landing page), indicators (URL, sender patterns, subjects, kit markers), and provides checks and remediation guidance to stop self-inflicted authentication failures and detect credential-harvesting campaigns.