Best of the Worst: The Week Your Security Tools Became the Disguise

This weekly Threat Intelligence roundup details five real phishing/vishing/BEC incidents in which attackers abused trusted infrastructure (vendor URL wrappers, Microsoft Safe Links and Bookings, calendar invites) to bypass automated controls; notable findings include widespread SPF/DKIM/DMARC passes masking malicious intent, DKIM body-hash failures indicating in-transit modification, and a zero-link callback phishing attack that entirely evades URL and sandbox defenses, with actionable recommendations to inspect deep redirect chains, treat DKIM body-hash failures on financial emails as critical, and train finance teams for callback phishing.