Phishing — LOTS Platform Abuse with KYC Lure
Threat actor abused a legitimate B2B document signing SaaS platform (LOTS pattern) to target two named employees with a KYC compliance lure impersonating a major professional services firm. The sending domain passes SPF/DKIM and reputation checks — detection relies entirely on content and behavioural analysis. RF Score 15 on attacker-controlled source IP. Both emails hard-deleted, zero clicks confirmed, no compromise.
Living Off Trusted Sites (LOTS) is an attack pattern in which threat actors abuse legitimate, reputable third-party platforms to deliver malicious content — exploiting the trusted sender reputation of the platform to bypass email security filters. In this incident, the attacker registered an account on a legitimate B2B document signing SaaS service and used it to send a fraudulent KYC (Know Your Customer) document request to named employees.
The LOTS technique is particularly effective because the sending domain is genuinely legitimate: it passes SPF, DKIM, and DMARC authentication checks, and its IP reputation is clean. Traditional email reputation filters will not flag it. Detection depends entirely on content analysis, user reporting, and the ability to separate the platform's identity from the attacker's identity behind it.
This incident is the second against the same client within six days, following IR-2025-001. The two-employee targeting and the use of named employees' details indicates the attacker conducted OSINT reconnaissance on the organisation prior to the attack — likely sourcing names and email addresses from public professional networking profiles or the company website.
The email appeared to originate from the platform's standard notification sending address — a legitimate domain that passes SPF/DKIM. However, the critical analytical step in LOTS investigation is extracting the Participant field from the email headers: the actual identity behind the notification. The participant was an external PEC address (Posta Elettronica Certificata — Italian certified email infrastructure). This is the attacker's controlled identity.
The source IP (50[.]31[.]156[.]XXX) returned an RF Score of 15 from Recorded Future — elevated, attributable to a US commercial data centre (ASN: AS23352). This IP represents the attacker's infrastructure used to register and operate the SaaS account, not the platform's own sending IP. Separating these two IPs is the defining analytical step in LOTS triage: the platform's IP will score clean, the attacker's infrastructure IP reveals the risk.
Each of the two targeted employees received an email with a unique per-recipient tracking token embedded in the document URL. This is a deliberate targeting mechanism that allows the attacker to confirm which email addresses are active and engaged — characteristic of targeted spearphishing rather than bulk delivery. The attacker had specific knowledge of at least two named employees' email addresses, consistent with prior OSINT activity.
The KYC pretext was well-constructed for the target sector. Energy and maritime organisations routinely engage in third-party due diligence processes involving document exchanges with professional services firms. The lure — impersonating a major professional services firm requesting KYC compliance documentation — exploits sector-specific workflows that employees are conditioned to treat as routine.
Both emails were hard-deleted via their individual Network Message IDs. The SaaS platform's domain was deliberately not blocked globally — doing so would have disrupted legitimate business use of a platform the client likely uses for genuine document workflows. Only the specific attacker document URLs were logged as indicators.
| Type | Indicator | Notes |
|---|---|---|
| Email Sender | app@[SaaS-PLATFORM-REDACTED][.]com | Legitimate platform abused — LOTS pattern, do NOT block globally |
| Participant | [REDACTED]@pec[.]com | Attacker-controlled Italian PEC address — real identity behind the notification |
| Source IP | 50[.]31[.]156[.]XXX | RF Score: 15 — US commercial data centre (ASN: AS23352) |
| URL | hxxps://app[.]saas-platform[REDACTED][.]com/email/documents/[ID]/at/[TOKEN_1] | Attacker document — recipient 1 tracking token embedded |
| URL | hxxps://app[.]saas-platform[REDACTED][.]com/email/documents/[ID]/at/[TOKEN_2] | Attacker document — recipient 2 unique tracking token |
| Message IDs | [REDACTED_MESSAGE_ID] (×2) | Network Message IDs — M365 admin audit trail, both recipients |
| Tactic | Technique | ID | Observed |
|---|---|---|---|
| Initial Access | Phishing: Spearphishing Link | T1566.002 | Targeted two named employees — attacker had prior directory knowledge |
| Initial Access | Trusted Relationship Abuse / LOTS | T1199 | Legitimate SaaS domain used to inherit email reputation and bypass filters |
| Reconnaissance | Gather Victim Identity Information | T1589 | Two named employees targeted — implies prior OSINT reconnaissance |
| Collection | Phishing for Information | T1598 | KYC lure designed to harvest corporate and personal compliance information |
// Find both recipient mailboxes by sender domain
EmailEvents
| where SenderMailFromDomain contains "[saas-platform-redacted]"
| where Timestamp > ago(24h)
| project Timestamp, RecipientEmailAddress, NetworkMessageId, DeliveryAction, SenderIPv4
// Confirm zero clicks on both tracking token URLs
UrlClickEvents
| where Url contains "saas-platform-redacted"
| where Timestamp > ago(24h)
| project Timestamp, AccountUpn, Url, IsClickedThrough, ActionType
// Hunt for any other emails from the attacker PEC address across tenant
EmailEvents
| where SenderMailFromAddress contains "pec.com"
| where Timestamp > ago(7d)
| project Timestamp, RecipientEmailAddress, SenderMailFromAddress, Subject, DeliveryActionSecond phishing incident against the same client within six days — IR-2025-001 involved genuine phishing emails with a subsequent awareness campaign disclosure; this is a distinct targeted attack. The two-employee targeting and the PEC address indicate the attacker conducted prior research on the company.
RF Score of 15 on the source IP was a useful early indicator — the SaaS platform itself would score much higher, which is exactly why the attacker chose to route through it. Separating the platform's IP score from the attacker's infrastructure IP score is the key analytical step in LOTS investigations.
The KYC pretext is particularly potent in energy and maritime sectors where third-party due diligence is routine. This incident pattern (LOTS + business document pretext + targeted spearphishing) is increasing in frequency.