Executive Summary
A sophisticated phishing campaign has been identified leveraging the Upflow.io billing platform and legitimate email infrastructure to conduct invoice fraud. Attackers utilized a subdomain of a global organic certification body (ecocert[.]com) and Mailgun services to deliver emails that passed all technical authentication checks including SPF, DKIM, and DMARC (compauth=100).
The campaign is notable for its use of tokenized URLs containing JSON Web Tokens (JWT) with 'portal.view' permissions. These tokens allow anyone possessing the link to access customer billing portals without requiring credentials, effectively bypassing standard login security. The secondary goal is financial theft via a PDF invoice that directs payments to a fraudulent French IBAN and BIC, while a tracking pixel confirms victim engagement.
This threat is high-impact due to its ability to bypass Secure Email Gateways (SEGs) and URL scanners by utilizing legitimate third-party portal links and authenticated sender domains.