The Signature Block Was Real. One Link in It Was Not.
ID: fcd32f97-026a-5b63-9ff2-57f6a0aa7d77
STIX ID: report--fcd32f97-026a-5b63-9ff2-57f6a0aa7d77
Feed Name: IRONSCALES
Threat Score
An attacker who controlled a vendor law firm's Microsoft 365 mailbox replied to a multi-week billing thread with a clean spreadsheet and a single substituted signature hyperlink pointing to https://ohiotiger.com/ (Cloudflare human-verification interstitial) scored as malicious; SPF/DKIM/DMARC/ARC authentication passed because the mailbox itself was compromised, enabling the attacker to inherit trust—detection succeeded only due to the link verdict, and the mailbox and related messages were quarantined.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.