The Anatomy of a Phishing Campaign That Bypassed Every Filter — And What Stopped It

The Setup: Highly Targeted Pretexting

The attacker spent three weeks on OSINT before sending a single email. LinkedIn identified the CFO's executive assistant. The assistant had recently posted about onboarding a new wire transfer platform. The phishing email posed as the platform vendor's onboarding team, referencing the correct project name, the assistant's full name, and asking for a "DocuSign verification" before the go-live date.

The email originated from a domain registered 47 days prior — old enough to pass reputation checks. The DocuSign link pointed to a lookalike domain with a valid TLS certificate. The credential harvesting page was pixel-perfect.

Why Technology Failed

Every technical control worked as designed — and still failed:

• URL rewriting — scanned the link at delivery time; the phishing page loaded cleanly with no malicious payload detectable
• Domain reputation — 47-day-old domain had no bad reputation yet
• DMARC/DKIM/SPF — the attacker domain passed all authentication checks
• Sandbox detonation — the page fingerprinted sandbox environments and showed a benign page to automated scanners

What Stopped It

The assistant, having recently completed security awareness training that specifically covered wire transfer fraud, noticed the sender domain did not match the vendor's domain. They forwarded the email to the security team rather than clicking. The SOC confirmed phishing within 4 minutes and blocked the domain across all controls.

The Investment That Paid Off

A $3,000 security awareness training program stopped an attack that a $400,000 email security gateway missed. This is not an argument against technical controls — it is an argument for defense in depth where human awareness is a genuine layer, not an afterthought.