Executive Summary
In early June 2026, an accounts payable team at a marine-industry equipment manufacturer was targeted by a sophisticated phishing campaign that bypassed traditional Secure Email Gateway (SEG) controls. The attack utilized a genuine ServiceNow tenant belonging to a multinational consumer packaged-goods company to send legitimate, fully-authenticated ticket notifications. Because the mail originated from a real, authorized infrastructure, it passed SPF, DMARC, and Microsoft composite authentication checks.
The threat is notable because it contained no malicious links, attachments, or credential-harvesting pages. Instead, the 'payload' was the request itself, soliciting sensitive information including vendor IDs, recent invoice numbers, and partial bank details via a simple email reply. This data is likely collected to facilitate future, more convincing payment redirection fraud or business email compromise (BEC) attacks.
This incident highlights a critical gap in reputation-based security, where the legitimacy of the sending infrastructure (ServiceNow) and domain authentication provided a false sense of security for a hostile request. Organizations in the marine and manufacturing sectors should be particularly alert to unsolicited 'vendor verification' requests that originate from unrelated corporate domains.