Topic starter
25/10/2026 11:04 am
TL;DR: Attackers are using Microsoft Bookings, Safe Links and vendor URL wrappers to push phishing, vishing and BEC through trusted channels, according to IRONSCALES. Message checks can pass while intent stays concealed, so defenders need more than a simple authentication result.
Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Best of the Worst: The Week Your Security Tools Became the Disguise”.
Key questions
Q: Why do SPF, DKIM, and DMARC still fail in well-managed environments?
A: They usually fail because identity is fragmented across systems.
Q: What do security teams get wrong about callback phishing?
A: They often optimise for links and attachments, but callback phishing pushes the compromise into a phone conversation.
A: When phishing hides behind legitimate services or phone callbacks, traditional URL scanners often return benign verdicts and post-delivery controls have little to intercept.
Practitioner guidance
- Harden redirect-chain inspection Force detonation and reputation checks through every hop in wrapped links, including vendor wrappers, nested redirects, and final destination hosts.
- Escalate DKIM body-hash failures Treat financial-request emails with DKIM body-hash failures as high-confidence anomalies, even when SPF and DMARC pass.
- Build callback-phishing playbooks Add verification steps for finance and operations teams when an email contains a phone number, billing urgency, or a request to call support.
Bottom line: Attackers are increasingly using legitimate delivery infrastructure to make malicious messages look routine and safe.
Glossary terms: Credential Phishing, DKIM Body-Hash Failure, Trusted-Platform Abuse, Authentication Signal
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Authentication is not trust: this week’s cases show that origin checks can validate delivery while attackers still weaponise the message itself. SPF, DKIM and DMARC are necessary, but they cannot determine whether a business request, link wrapper, or callback instruction is legitimate. Practitioners should treat authenticated delivery as a gating control, not a trust decision.
A question worth separating out:
Q: How should organisations verify high-value financial requests that come through trusted channels?
A: Use independent verification for any request that changes money movement, account details or beneficiary data. The safe pattern is to validate the person and the instruction through channels the requester did not provide, then require a second approver for anything that creates financial exposure. Trust in the relationship is not enough when impersonation is cheap.
👉 Read our full editorial: Legitimate infrastructure is becoming the camouflage layer for phishing
This post was modified 7 days ago by NHI Mgmt Group