Executive Summary
A sophisticated phishing campaign leveraged the legitimate transactional email infrastructure of an Australian events venue to bypass standard email authentication protocols including SPF, DKIM, and DMARC. The attacker successfully delivered Ledger-branded firmware update lures that appeared fully authenticated because they originated from a verified Resend/Amazon SES subdomain belonging to a non-related commercial entity.
The technical chain utilized a series of redirects hosted on the venue's legitimate domain to conceal the final destination: a typosquatted domain designed to harvest cryptocurrency credentials. Although the terminal landing page was unreachable during analysis, the attack highlights a critical weakness in relying solely on email authentication, as threat actors can abuse misconfigured or compromised transactional email subdomains to borrow the reputation of legitimate businesses.