On 25 August 2026, Abnormal AI published an analysis of a phishing platform its researchers named ZeroTokens. The technical detail worth sitting with is not the platform itself. It is that every message in the campaign passed SPF, DKIM and DMARC, and it did so honestly. Nothing was forged. No record was bypassed. The mail was genuinely authorised to be sent by the domain it came from, and the receiving servers were correct to say so.
Exact-template hunting found more than 45,000 messages sent to over 24,000 recipients across more than 700 organisations, with more than 24,000 messages on a single peak day. If your inbound filtering treats a clean authentication result as a trust signal, this campaign is what that assumption looks like when someone builds a business around it.
How the mail authenticated
Three deliberate choices did the work.
The campaign used ten sender domains — four .com and six .asia — all registered through the same registrar and aged for five to eleven months before first use. A domain registered last week is a signal. A domain registered last spring is not.
None of the ten published an MX record. They could send mail; they were never configured to receive any. That is unusual for a domain claiming to belong to a financial institution, and it is a detectable pattern, but almost nothing checks for it.
Mail went out through nine abused SendGrid accounts. This is the part that matters most. The messages carried SendGrid's own DKIM signature, and SPF resolved against SendGrid's sending infrastructure, which is legitimately authorised to send for those accounts. The authentication result was not a trick played on the receiver. It was an accurate statement about a real sending relationship that the attacker had acquired by compromising someone's account with a large email service provider.
Ten subject templates mapped one-to-one onto the ten domains — one subject per domain, no rotation. The lure was W-8BEN tax-documentation recertification, a real process brokers use to re-verify a customer's identity. That pretext makes a later request for a driving licence number and a card number feel procedural, and it self-selects its audience: only holders of US securities have a W-8BEN on file.
What SPF, DKIM and DMARC actually assert
It is worth being precise, because the three records are usually explained as a single blob and then trusted as a single verdict.
SPF asserts that the connecting server appears on a list the domain owner published. It says this machine was allowed to send for this domain.
DKIM asserts that the message carries a valid signature from a key published in a domain's DNS, and that the signed parts were not altered in transit. It says this message was signed by someone holding that domain's key.
DMARC asserts that the domain in the From: header the recipient sees aligns with the domain that passed SPF or DKIM, and tells the receiver what the domain owner wants done on failure.
Read them together and you get one sentence: this message was sent by a server the domain owner authorised, and the visible sender matches. That is a statement about authorisation to send. It is not a statement about intent, about the accuracy of the content, or about whether the domain belongs to who you think it does. A domain registered eleven months ago by an attacker is, from SPF's point of view, just a domain with a correct record.
The shared-provider case sharpens it further. When mail is sent through a large email service provider, the signature that verifies is often the provider's, not the customer's. Compromise a customer account at that provider and the mail you send inherits authentication that was never about you.
One correction worth making
Coverage of this research has described ZeroTokens as phishing-as-a-service. Abnormal's own assessment is the opposite, and with high confidence: the operator console has only two roles, super_admin with full access and operator limited to the session board. That is a staffing model, not a customer model, so the researchers judge it very likely to be in-house tooling for a single group rather than a rented kit. The distinction matters for defenders — a single group's infrastructure can be mapped and disrupted as a unit, while a rented kit means many unrelated operators sharing tooling.
The operator is watching in real time
The second assumption this campaign breaks is that a one-time code protects the session.
The phishing page held an open WebSocket to the platform and reported the victim's current stage and field values as they were typed. A human operator watched the session board, then chose which of up to eight screens to show next, rather than running everyone through a fixed sequence. In parallel, the operator used the captured credentials in a separate browser session against the real institution. When the genuine bank sent the customer an SMS code, the operator told the phishing page to display the code prompt, collected the code as it was typed, and entered it upstream before it expired. Subsequent screens requested app-based push approval and, separately, a trading password.
If a step failed, the operator could trigger an error and ask again — a second chance at a usable code that commodity kits do not have. At the end the victim was redirected to the institution's real website.
So the exposure is not "a password was phished". It is a password, identity documents, card details, a one-time code, a push approval and a separate transaction credential, captured in one sitting, with the attacker already logged in upstream.
The signals that still carry weight
Authentication results are not useless. They are just not a verdict on trustworthiness. These carry more:
- Domain age measured against first-send date. A domain that has existed for eight months and sent its first mail yesterday is a stronger signal than either fact alone.
- Absence of an MX record on a domain that presents itself as a business you could reply to.
- A new sender domain tied to exactly one subject line, at volume. That pattern survives a rewrite of the lure text.
- Email service provider account identifiers, where visible. They link campaigns together across domain rotations, which is the attacker's cheapest move.
- Alignment rather than a bare pass — whether the domain you see in
From:is the domain that authenticated, or merely a domain that authenticated. - Reply-to divergence from the visible sender.
What to check on your own domain
None of the above changes the fact that your own records still need to be right — they are what stops someone spoofing you, which is a separate problem from what arrives in your inbox.
Worth confirming: that your SPF record ends in -all rather than ~all, and that you are under the ten-DNS-lookup limit that silently invalidates the record once a few departments each add a vendor. That your DMARC policy is p=quarantine or p=reject rather than p=none, which collects reports and blocks nothing. That DKIM signing is enabled on every service that sends as you, including the marketing platform and the ticketing system, not only the mail server.
Our email authentication check explains each record in the order you should fix them, and we looked at how many domains stall at monitoring mode in the DMARC enforcement gap. You can see the full list of what a scan covers on what ClickScan checks, and run one against your own domain from the scanner.
A scan will tell you whether your records are correct and enforcing. It will not tell you that a message arriving with a perfect authentication result was sent by a criminal eleven months into a patient domain-aging exercise — because at the protocol level, that message is valid. Treating the green check as the end of the conversation is the gap this campaign was built to walk through.
Note on sourcing: the campaign details, infrastructure counts and platform assessment come from Abnormal AI's own research. The judgement that ZeroTokens is in-house tooling rather than a rented service is the researchers' stated assessment, not a confirmed fact, and no operator identity was recovered.
Sources: Abnormal AI — ZeroTokens: Phishing Platform Gives Operators Real-Time Control of Attack Flow; Infosecurity Magazine — ZeroTokens Phishing Platform Steers Attacks in Real Time; RFC 7208 — Sender Policy Framework; RFC 6376 — DomainKeys Identified Mail; RFC 7489 — DMARC.