Reply-only phishing via spoofed ServiceNow ticket requesting vendor/bank/invoice data

Ethan Andrews@eandrews

•updated Aug 4, 2026•4•0•13

Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.