Salesforce Sites Phishing: The Attacker Owned Nothing

A high-severity phishing campaign targeted a UK fintech by sending a legitimate-looking deactivation notice that authenticated via a billing vendor's valid DKIM-signed transactional mail and landed on a genuine Salesforce Sites org; the attacker relied entirely on third-party infrastructure and a reply-based exfiltration path requesting the Organization ID to harvest access, defeating conventional reputation and link-based defenses.