Check Point Research recently disclosed a phishing campaign that did not need a single fake domain, a spoofed sender, or a cloned login page to work. Researchers found more than 3,200 copies of the same message: a summer job offer sent from a genuinely compromised, legitimate school mailbox, linking to a real Google Forms page hosted on Google’s own infrastructure. Every signal a mail server checks came back clean, because none of it was forged. That is what makes the campaign worth studying closely.
A Job Offer With No Fake Domain to Spot
The email invited students to apply for flexible summer work through a “secure” application form. There was no strange sending domain, no cloned brand, and no malware attachment. The message came from a real school account that a security team would have every reason to trust, because the account itself had not been impersonated. It had been taken over. The attacker simply used it to reach the school’s own student mailing lists, then let Google Forms do the rest of the work of looking legitimate.
The Two Questions That Gave It Away
The form asked for the basics any job application collects: name, contact details, availability. Two questions stood out to researchers. One asked for the applicant’s financial institution, something no legitimate employer requests before making a formal offer. The other asked for the applicant’s official school email address, a detail that serves no purpose in a job application but is extremely useful for credential harvesting, account takeover, or laundering fraudulent transactions through a fresh identity. Together, those two questions point toward money mule recruitment: using students as unwitting intermediaries to move stolen funds, dressed up as a paid summer gig.
Why DMARC Passed Every Single Time
DMARC checks whether a message’s sending domain authorized the infrastructure that sent it. In this campaign, the answer was always yes, because the mailbox doing the sending was the school’s own, sending through the school’s own authorized infrastructure. SPF passed. DKIM passed. DMARC passed. None of those protocols were designed to ask whether the account behind an authorized domain had been quietly taken over, whether the content of a message made sense coming from that account, or whether the form it linked to was collecting information no legitimate process would need. That gap between authenticated and trustworthy is exactly where this campaign lived, and it is why detecting it required looking at sender behavior and message intent, not just authentication headers.
What Security Teams Should Do Now
Treat unusual mailbox behavior as a compromise signal, not just a content signal. A school, university, or business account that suddenly sends bulk mail to a list it has never emailed before is a stronger indicator of takeover than anything in the message body.
Flag applications and forms that request financial details before any offer is made. That single data point is one of the most reliable tells in money mule recruitment, and it is easy to build detection rules around regardless of where the form is hosted.
Do not treat “hosted on a trusted platform” as equivalent to safe. A Google Forms link, a Microsoft Forms link, or any other form built on legitimate infrastructure inherits none of that platform’s reputation for the content it collects.
Keep DMARC enforced at p=reject on every domain you own regardless of this campaign’s mechanics. It will not stop an attacker who compromises an account you already trust, but it closes the far more common path of attackers registering lookalike domains to spoof you outright, which is still where most volume comes from.
The Takeaway
This campaign worked precisely because nothing about it looked technically wrong. The domain was real, the mailbox was real, the authentication passed, and the form lived on infrastructure students use every day. DMARC did exactly what it is built to do here, and that was still not enough, because the question this campaign answered was never about whose domain sent the mail. It was about whether the account behind that domain could still be trusted, a question DMARC was never designed to ask.
Excello Mail keeps the domains you own fully authenticated and enforced, closing off the cheapest spoofing paths so your team’s attention goes where it is actually needed, on account-compromise threats like this one that no authentication record alone can catch. Sign up for free to Excello Mail to see your domain’s real authentication posture today.