A phishing campaign targeting hotels across Europe and Asia since April 2026 has exposed a structural weakness in how most enterprise email security actually works: it routes malicious messages through Calendly’s own notification infrastructure, so the mail passes every authentication check a corporate filter runs, before deploying a stealthy Node.js backdoor on front-desk computers. Microsoft Threat Intelligence disclosed the campaign on June 25, 2026, naming the technique “authentication laundering.” Because the email is genuinely sent from Calendly’s authorized servers, SPF passes, DKIM passes, and DMARC passes — the composite result a filter sees is clean, even though the payload behind the link is not.

It is not an isolated case. Cisco Talos independently documented the same category of attack in April 2026, dubbed “Platform-as-a-Proxy,” after finding attackers abusing GitHub’s and Jira’s own notification systems the same way — on the peak day of one campaign, roughly 2.89% of all mail originating from GitHub’s infrastructure was tied to the abuse pattern. Any SaaS platform that emails on a user’s behalf, from scheduling tools to e-signature and CRM platforms, can be turned into the same kind of proxy.

Authentication laundering is also only one entry in a wider pattern this year. AI-generated lures, QR codes standing in for links, and adversary-in-the-middle proxies that steal a live MFA session are all evidence of the same underlying shift: attackers have stopped trying to beat email filters head-on and started routing around the specific signals those filters trust.

Authentication Laundering: When the Mail Really Is Legitimate

SPF, DKIM, and DMARC were built to confirm that a sender is authorized to send on behalf of a domain — not to judge whether the content of an authorized message is malicious. When an attacker gains a legitimate account on a trusted SaaS platform, every check passes by design. In the hotel campaign, messages carried the display name “Booking Manager (via Calendly)” and referenced guest complaints, bedbug reports, and stay-review requests in Japanese, Danish, and Dutch — plausible enough for front-desk staff, and authenticated cleanly enough to sail past filters that stop evaluating once SPF/DKIM/DMARC come back green. The embedded link ran through a four-hop redirect chain, a Cloudflare Turnstile human-check, and finally a ZIP archive containing an image file disguised as a Windows shortcut — which, once opened, launched a PowerShell chain that pulled down a legitimate, signed Node.js runtime to execute the actual malicious code in memory.

The Broader 2026 Pattern: AI Lures, QR Codes, and Session Theft

The same routing-around-trust-signals logic shows up across this year’s other major phishing vectors. Hoxhunt’s threat data shows AI-generated phishing’s share of reported attacks spiking sharply during peak season and settling near 40% of all attacks through the first half of 2026, with AI-crafted lures landing click-through rates as high as 54% against roughly 12% for traditionally written emails — the content signal that used to tip off both employees and filters (typos, stiff phrasing) has largely disappeared.

QR-code phishing shows the same logic applied to a different channel: encoding the destination in an image rather than text routes around scanners built to read links, and recent coverage puts the surge in AI-assisted smishing, quishing, and voice-clone scams at 14x over the past year. And in January 2026, the FBI issued a flash alert describing Kimsuky, a North Korea-linked group, embedding QR codes in spear-phishing emails that led, in every observed case, to session-token theft via adversary-in-the-middle (AiTM) proxying — defeating MFA not by cracking it, but by stealing the already-authenticated session behind it.

The payoff for attackers routing around trust signals rather than breaking them is BEC: phishing now drives an estimated 85% of business email compromise incidents, global phishing losses run near $25 billion a year, and the average cost of a phishing-driven breach reached $4.88 million in 2025, up nearly 10% year over year.

Read more: Sorb Security’s Phishing Trend Data — Email Security in 2026

Why SPF/DKIM/DMARC and Signature-Based Filters Can’t Catch This Alone

Most email security stacks still lean on three assumptions: that a passing authentication result means a trustworthy sender, that a known-bad signature or blacklisted URL will catch malicious content, and that a scanned attachment has actually been opened and inspected. Authentication laundering defeats the first assumption directly. AI-generated content defeats the second, because there is no reused template to match. And a password-protected or encrypted attachment defeats the third, because the scanner never sees what’s inside it. None of this means authentication checks are worthless — it means they were never designed to be the last line of defense, and campaigns like the Calendly one are exploiting organizations that treat them as if they were.

How Sorb Security’s SCES Platform Closes the Gap

Sorb Security’s Cloud Email Security (SCES) platform is built around a simple premise that follows directly from the incidents above: detection has to keep running after a message passes authentication, not stop there. Each module below is designed to catch a specific piece of the pattern that SPF/DKIM/DMARC and static filtering were never built to catch.

Content and sender-intent detection that doesn’t stop at a clean SPF/DKIM/DMARC result. Sorb layers AI, machine learning, and heuristic content analysis — tunable through its AskSorb AI policy engine — on top of authentication checks, so a message from a genuinely authorized sender (a real Calendly account, a compromised but legitimate mailbox) is still evaluated on what it’s asking the recipient to do, not just where it came from.

An Attachment Engine that opens what authentication checks never look inside. Sorb extracts and cracks password-protected or encrypted attachments before the antivirus check runs, and separately pulls hyperlinks and embedded content out of attachments and images — the same category of trick used in the Calendly campaign’s disguised .lnk file. A dual-AV, dual-sandbox architecture then detonates the result twice through independent engines, including Sorb Cloud Sandbox, built specifically to catch zero-day payloads and resist the password-evasion tricks that beat single-engine sandboxes.

A Zero Trust URL Engine that re-checks every link at the moment it’s clicked. Rather than trusting a one-time scan at delivery, Sorb rewrites every link and re-evaluates it at click-time, with dynamic AI-based analysis capable of navigating CAPTCHA challenges to inspect the real landing page — closing the exact redirect-chain-and-Turnstile trick used in the hotel campaign. Browser air-gapping and read-only surfing isolate web content from the endpoint entirely, so even a convincing AiTM proxy page never gets a live credential or session token to steal.

A BEC protection suite that judges sender behavior, not sender authentication. Because BEC and authentication-laundering both rely on a technically “legitimate” sender, Sorb traces the slightest differences between a fraudulent sender and the real one, checks signature patterns against mail history, and triggers alerts the moment a sender anomaly appears — independent of whether SPF, DKIM, and DMARC all passed.

A continuous, user-facing security layer. An interactive banner warns end users about sender legitimacy and content risk and lets them report suspicious mail directly, converting the front-line employee — a hotel front-desk clerk, a finance approver — into an active sensor rather than the weakest link the next campaign is built to exploit.

Frequently Asked Questions

How does authentication laundering get past SPF, DKIM, and DMARC checks?

The attacker sends through a legitimate platform’s own infrastructure — a real Calendly, GitHub, or Jira account — so the mail server, sending domain, and DKIM signature are all genuinely authorized. All three checks pass because the infrastructure is legitimate, even when the message content or destination link is not.

Does Sorb replace SPF, DKIM, and DMARC, or work alongside them?

Alongside them. Sorb’s Email Firewall enforces SPF, DKIM, and DMARC as a baseline layer, then adds AI-based content analysis, click-time URL re-evaluation, and BEC-specific anomaly detection on top — so a message that passes authentication still has to clear behavioral and content checks before it reaches the inbox unflagged.

Why are AI-generated and QR-code phishing harder to catch than older phishing emails?

Both route around the specific signal a filter or employee would normally rely on: AI-written text removes the grammar and phrasing tells that used to flag an email as suspicious, and a QR code moves the malicious destination into an image where text-based link scanners can’t read it. Catching either requires evaluating intent and behavior rather than matching known-bad patterns.

What should security teams watch for beyond a clean authentication result?

Unexpected file types disguised as something else (an image that’s really a shortcut), any scheduling or notification email that results in a downloaded archive, sender behavior that deviates from established history even when the domain checks out, and links that lead to a CAPTCHA-gated page before revealing their real destination.