What is Lyrie Research?

Lyrie Research is an autonomous cybersecurity intelligence platform publishing verified threat intelligence including critical CVEs, active exploitation reports, breach analysis, and original research — every article cross-validated by 3+ primary sources.

How does Lyrie.ai protect against rogue AI threats?

Lyrie.ai uses machine-speed autonomous defense to detect and neutralize rogue AI, prompt injection, and AI supply chain attacks. It responds before human analysts can react.

What cybersecurity topics does Lyrie Research cover?

Lyrie Research covers CVE deep dives, CISA KEV actively exploited vulnerabilities, data breach forensics, original cybersecurity research, and AI threat intelligence including agent-based attacks.

How often is Lyrie Research updated?

Lyrie Research is updated continuously by the autonomous Lyrie Sentinel engine, publishing new threat intelligence multiple times daily as new CVEs, exploits, and breaches are confirmed.

Is Lyrie Research free to access?

Yes, all articles on Lyrie Research are freely accessible. For active protection by the same intelligence engine, visit lyrie.ai.

The Authentication Gap: Why BEC Attackers Weaponized DKIM Failure While DMARC Kept Saying Pass

← Defensive-Playbook

0 sources verified·11 min read

By lyrie-threat-intelligence·4/30/2026

TL;DR

A purchase order fraud email arrived with a 27-year-old legitimate sending domain, SPF pass, DMARC pass, and a Microsoft Composite Authentication score of 100. DKIM failed — but because DMARC only requires either SPF or DKIM alignment, the policy evaluated clean. The only technical signal was the DKIM failure; everything else pointed at legitimate mail. The attacker used a Proxmox Mail Gateway to break DKIM post-signing, exploiting a protocol design quirk that is nearly universal in mid-market organizations.

This is not a novel attack. It is a reproducible exploitation of how DMARC's "OR logic" works against defenders. Abnormal AI's 2026 Attack Landscape Report, analyzing 800,000+ email attacks across 4,600+ organizations, confirms VEC (Vendor Email Compromise — BEC using compromised vendor accounts) now accounts for more than 60% of all BEC attacks. The FBI IC3 2024 report documented $2.77 billion in adjusted BEC losses. Authentication is failing at the protocol level. Defenders need to stop trusting authentication pass/fail as a binary gate.

Background: The $2.77 Billion Authentication Illusion

Business Email Compromise is structurally different from phishing. Phishing sprays lures at volume and accepts a low hit rate. BEC is precision surgery: one email, one target, one workflow exploitation point. The operational logic is exactly backwards from ransomware — instead of encrypting data and demanding payment, BEC redirects payment before anyone realizes the instructions were fraudulent.

The FBI classifies BEC under five categories: fake invoice fraud, CEO fraud (executive impersonation), account compromise, attorney impersonation, and data theft. In 2024, BEC produced more adjusted losses than ransomware, cryptocurrency fraud, and tech support fraud combined. The $2.77 billion figure only captures reported cases; the Verizon 2024 DBIR found pretexting (the social engineering category that encompasses BEC and invoice fraud) accounts for more than 40% of all financially motivated breaches.

The attack class that now dominates BEC is Vendor Email Compromise (VEC). In VEC, the attacker does not impersonate an executive — they compromise a real vendor's email infrastructure, then send invoice fraud directly from the vendor's actual domain. When SPF passes, DMARC passes, and the domain has 27 years of reputation history, the human recipient has no technical signal that anything is wrong.

The authentication gap is not a DMARC misconfiguration in the traditional sense. It is a protocol design choice — DMARC's "OR logic" — being weaponized deliberately.

Technical Analysis: How the DKIM-Break Works

The Proxmox Mail Gateway Vector

The IronScales case documented in April 2026 illustrates the mechanism cleanly. The email originated from an internal workstation (192.168.60.130) at what appeared to be a legitimate manufacturing vendor. The message passed through an internal mail server, then routed through pmg.imtec-inc[.]com (216[.]81[.]103[.]118) — a Proxmox Mail Gateway deployment.

Proxmox Mail Gateway is an open-source email security appliance common at small and mid-size organizations. It performs content filtering, antivirus scanning, and header rewriting on outbound mail. These processing steps modify message content after the originating mail server has applied the DKIM signature. Any modification to signed headers or message body after DKIM signing invalidates the signature — by design, because DKIM is supposed to detect exactly this kind of post-transit modification.

The authentication chain produced:

| Signal | Result | Mechanism |

|--------|--------|-----------|

| SPF | Pass | Sending IP (216.81.103.118) was in the domain's SPF record |

| DKIM | Fail | Body hash mismatch — PMG modified content after signing |

| DMARC | Pass | Policy action=none; SPF alignment succeeded (envelope From = header From domain) |

| MS compauth | 100 | Microsoft Composite Auth scored perfect because DMARC passed |

| SCL | 1 | Lowest non-zero spam confidence level |

The attacker leveraged a fundamental truth of DMARC: the protocol requires either SPF alignment or DKIM alignment. When SPF carries the alignment, a completely broken DKIM signature is invisible to DMARC policy evaluation. Microsoft 365, Google Workspace, and virtually every major receiving MTA are identical in this respect — they follow the RFC.

The OR-Logic Trap

The specific attack pattern follows three steps:

1. Compromise a vendor's mail infrastructure (or use a lookalike domain with valid SPF records)

2. Route through any MTA component that modifies content post-signing — breaking DKIM but leaving SPF intact

3. Send a behaviorally credible email (matching PO format, dollar amounts below approval thresholds, using domain with reputation history)

The DMARC p=none policy (monitoring mode) compounds the problem. An organization running p=none gets DMARC aggregate reports but takes no enforcement action on failures. IronScales found the sending domain's DMARC policy was action=none — meaning even if DMARC had failed, no quarantine or reject action would have occurred.

Attack Psychology: The PO Sweet Spot

The email contained one word in the body: "Fyi." The attachment was a 7 KB PDF with no JavaScript, no forms, no embedded links — nothing that endpoint AV or sandboxing would flag. The PO amount was $3,451.73.

The $2,000–$5,000 range is calculated. Most organizations require additional approvals for transactions above $5,000–$10,000. Accounts payable staff processing dozens of POs daily operate on muscle memory — matching subject line numbers to attachment numbers and routing for payment. The attacker matched the subject line (p.o. 4506616378) to the job number in the PDF. Consistency eliminates manual review triggers.

Abnormal AI's 2026 data confirms: VIP impersonation dominates at small enterprises (43% of BEC attacks), while lateral account compromise (one compromised employee targeting another) rises to 23%+ at large enterprises. The vendor impersonation model scales across both.

The 2026 BEC Threat Landscape

Abnormal AI's analysis of 800,000 email attacks across 4,600 organizations (2026 Attack Landscape Report) reveals the current attack distribution:

Phishing: 58% of all attacks — still dominant, now using redirect chains (20% of phishing attacks) to obscure final malicious URLs from security tools
BEC: 11% of attacks — lower frequency, dramatically higher financial impact per incident
VEC: >60% of all BEC — vendor compromise now the majority BEC vector

Nearly 40% of all BEC attacks exploit trust in colleagues, executives, or internal departments. 45% of these impersonate HR, finance, or procurement — exactly the workflow touchpoints that control payment authorization. More than 20% of phishing attacks now use redirect chains combining link shorteners (tinyurl 31.6%, t.co 26.6%) with legitimate hosting platforms to evade URL-based filtering.

The Q1 2026 ransomware picture from ReliaQuest adds context: total leak-site posts hit 2,638 (up 22% YoY), with the shift toward identity-first intrusion (ShinyHunters' SaaS-native approach) demonstrating that credential compromise is the shared entry point for both ransomware and BEC. Identity infrastructure is the common denominator.

Detection Engineering: What Actually Catches This

Standard email gateway controls fail against the DKIM-break/SPF-pass pattern because the email genuinely passes the authentication protocols as designed. Detection must shift from protocol signals to behavioral signals.

Layer 1: Authentication Signal Correlation

DKIM-fail with DMARC-pass is an anomaly pattern. A legitimate vendor whose DKIM fails consistently is experiencing a mail infrastructure misconfiguration — either the PMG or another post-signing processor is breaking signatures. This pattern deserves escalated scrutiny even when DMARC passes:

Detection Logic:
  IF spf=pass AND dkim=fail AND dmarc=pass AND compauth=100
  THEN: flag for behavioral review, do NOT auto-trust

Deploy this as a custom mail flow rule or SIEM correlation. Microsoft 365 exposes these signals in the X-MS-Exchange-Authentication-Results header.

DMARC policy mode matters. If the sending domain's DMARC policy is p=none, the sending organization has no enforcement — DMARC reports are generated but no action is taken on failures. Receiving organizations should weight p=none domains lower in reputation scoring.

Layer 2: Behavioral Signals (the ones that caught this)

IronScales detected the attack at 60% confidence on behavioral signals alone:

1. First-time external sender — this sending domain had never mailed this organization before

2. VIP recipient targeting — the email went to accounts payable or a financial decision-maker

3. Invoice patterns inconsistent with established vendor relationships — the "vendor" had no prior invoice history in the receiving environment

Additional behavioral signals to build detections around:

Dollar amount clustering in the $2,000–$5,000 range from first-time senders
PDF-only attachments with no prior thread context (no "Re:", no forwarded chain)
Single-word or near-empty email bodies referencing attachment content
Subject line/attachment content number matching — attackers do this to appear consistent; detecting the pattern flags the behavior class
New domain registered less than 90 days ago sending invoices (lookalike domains)

Layer 3: Identity Verification Controls

VEC is fundamentally an identity trust problem. The vendor's credentials or mail infrastructure were compromised. Detection at the email layer is a second-line defense. Primary prevention:

Vendor/supplier identity verification for any payment instruction change — phone callback to a known number (not the one in the email)
Payment workflow 4-eyes rule for first-time vendors and any bank account change requests
Accounts payable training focused on "the email is real, the fraud is in the instruction" — attackers increasingly use legitimate domains

IOC Context

The specific IronScales case involved:

Sending domain: imtec-inc[.]com (27-year-old domain, legitimate manufacturing company)
Sending IP: 216[.]81[.]103[.]118 (pmg.imtec-inc[.]com — Proxmox Mail Gateway)
DKIM selector: pmg2025 (post-processing MTA, not the originating mail server)
Attachment: ack13023.pdf — clean PDF, no malicious content, pure social engineering

Note: The imtec-inc.com domain appears to be a compromised legitimate vendor, not an attacker-controlled domain. IOC sharing for this class of attack is limited — the "malicious" IP is a real organization's mail server. Detection must focus on behavioral patterns, not IP/domain blocklists.

Lyrie Take

The DKIM-break/DMARC-pass pattern is a precision exploit of email authentication's OR-logic architecture. It has existed as a theoretical attack for years; what changed in 2025–2026 is operationalization: PMG deployments are common, SPF records are widely maintained, and the attack chain is now reproducible at scale without requiring DKIM key theft or domain hijacking.

The deeper problem is that DMARC was designed as a sender protection mechanism — it protects domain owners from impersonation. It was never designed to protect receiving organizations from compromised vendor accounts that legitimately pass SPF alignment. The protocol does what it says it does. The defensive gap is relying on protocol authenticity as a proxy for behavioral legitimacy.

Lyrie's autonomous detection layer approaches this correctly: authentication signals are one input among many. Behavioral baselines (this sender has never contacted this recipient; this attachment format hasn't appeared in this context; this dollar range is anomalous for this recipient's usual vendor set) are the signals that close the gap. Running detection at machine speed means these baselines can be computed per-recipient, not per-organization — a level of granularity that rule-based mail gateways cannot achieve.

VEC is the current dominant BEC vector precisely because it defeats authentication. The defenses that work are the ones that don't rely on authentication as a gate.

Defender Playbook

Immediate (0–24h)

1. Audit DMARC policy for your own domains. If p=none, move to p=quarantine. If p=quarantine, evaluate readiness for p=reject. Each step reduces spoofing risk for your vendors and customers.

2. Enable DKIM failure alerting in your email gateway. Configure a mail flow rule or SIEM correlation: dkim=fail AND dmarc=pass AND first-time-sender = TRUE → flag for SOC review.

3. Check your MTA pipeline for post-signing content modification. PMG, Mimecast, Proofpoint, and other mail security appliances that rewrite headers or scan/modify bodies after DKIM signing will break DKIM signatures for all outbound mail. Either sign after filtering (preferred) or ensure your MTA pipeline is DKIM-aware.

Short-Term (1–2 weeks)

4. Implement vendor payment controls. Any first-time wire instruction, bank account change, or large invoice from a new vendor requires out-of-band voice verification to a pre-registered number. This single control stops the majority of successful VEC attacks regardless of email authentication state.

5. Deploy behavioral email analysis that baselines first-time sender behavior, VIP targeting patterns, and invoice content anomalies. Traditional gateway rules look at content; behavioral analysis looks at context.

6. Train accounts payable specifically on the "clean email, fraudulent instruction" attack model. The spear-phishing model (malicious attachment, suspicious link) is now less common than the "legitimate email from trusted-looking domain with a fraudulent PDF."

Medium-Term (2–8 weeks)

7. Build a vendor email registry. Maintain a list of expected sending domains, signing selectors, and sending IPs for your top 50 vendors. Flag deviations — a vendor suddenly sending from a new IP or with a broken DKIM selector is a compromise signal.

8. Implement BIMI (Brand Indicators for Message Identification) for your own domains if you want to signal authentication status to recipients. BIMI requires p=quarantine or p=reject DMARC — this creates an incentive to harden your own policy while adding recipient-visible trust signals.

9. Participate in DMARC aggregate report analysis. RUA reports show every source sending mail from your domain. Unknown sources indicate either a mail infrastructure shadow-IT problem or an active spoofing attempt.

10. Integrate threat intel on compromised mail infrastructure. PMG honeypots, AbuseIPDB reports, and threat intel feeds tracking compromised MTA infrastructure can flag sending IPs before they reach your inbox.

Sources

1. IronScales Threat Intelligence (April 2026): "SPF and DMARC Passed, DKIM Failed: How a One-Word Email Body and a Clean PDF Almost Delivered a BEC Payday" — https://ironscales.com/threat-intelligence/dkim-fail-spf-dmarc-pass-proxmox-po-invoice-vendor-impersonation

2. Abnormal AI, 2026 Attack Landscape Report: Analysis of 800,000 email attacks across 4,600+ organizations — https://files.abnormalsecurity.com/production/files/2026-Attack-Landscape-Report.pdf

3. SecurityWeek (April 2026): "The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface" — https://www.securityweek.com/the-behavioral-shift-why-trusted-relationships-are-the-newest-attack-surface/

4. FBI IC3 2024 Annual Report: BEC adjusted losses $2.77B — https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf

5. Verizon 2024 DBIR: Pretexting accounts for 40%+ of financially motivated breaches — https://www.verizon.com/business/resources/reports/dbir/

6. Paubox (April 2026): "74% of breached healthcare domains had ineffective DMARC policies in 2025" — https://www.paubox.com/blog/74-of-breached-healthcare-domains-had-ineffective-dmarc-policies-in-2025

7. ReliaQuest (April 2026): "Ransomware and Cyber Extortion in Q1 2026" — https://reliaquest.com/blog/threat-spotlight-ransomware-and-cyber-extortion-in-q1-2026/

8. RFC 7489 (DMARC): Domain-based Message Authentication, Reporting, and Conformance — https://datatracker.ietf.org/doc/html/rfc7489

9. RFC 6376 (DKIM): DomainKeys Identified Mail Signatures — https://datatracker.ietf.org/doc/html/rfc6376

Lyrie.ai Cyber Research Division — Senior Analyst Desk