One Email, Two DMARC Identities, One Delivery Path

The report analyzes a high-severity phishing incident where an attacker embedded multiple header-shaped strings inside the From display name so different mail parsers resolved the sending identity to different domains, producing divergent DMARC evaluations; with DKIM missing at every hop there was no signature to reconcile the conflict. The message contained a one-click credential-harvesting lure, visible obfuscated text using zero-height elements, and IOCs (docs-secured.com, [email protected], 37.218.222.172); the author recommends detection rules (alert on address-shaped display names, diff header.from across Authentication-Results, treat "absent" as unevaluated, require DKIM) to mitigate this failure mode.