We recently pulled apart a corporate identity scheme that quietly worked its way through a customer’s commercial sales team. I want to walk you through exactly how it played out, because the mechanics are sharper than most phishing you’ve probably seen written up before.
Security researchers call this pattern an Inverted Web-to-Email Procurement Scam. It flips the usual phishing script. Instead of an email landing in your inbox and asking you to click something, the attacker starts on your website and waits for your team to reach out.
Sales teams are wired to respond fast. A polished enquiry from a recognisable brand name looks like exactly the kind of lead worth chasing. Attackers know this. Schneider Downs’ cyber risk advisory team has documented the trend: threat actors are increasingly skipping email entirely and submitting their opening move through ordinary website contact forms. A message typed directly into your own form doesn’t look like an attack to a spam filter. It looks like a customer.
Here’s the blueprint, based on the incident our analysts worked through.
1. A Convincing First Contact
The attack opens on the company’s contact or quote page. An automated script submits a clean, text-only enquiry using the name and role of a real executive at a legitimate, creditworthy business. The wording is professional and unremarkable. It asks about delivery lead times and payment terms, the sort of thing any genuine buyer would ask.
2. A Domain That Almost Matches
The reply-to address sits on a carefully registered lookalike domain, missing or swapping a single character from the real company’s web address. A sales rep, keen to land what looks like a serious pipeline opportunity, hits reply. From that point on, the entire thread runs straight to the fraudster instead of the business the rep thinks they’re talking to.
3. Building a Believable Buyer
The person on the other end plays the part of a corporate buyer well. They stay professional. They reference real regional project details to justify the enquiry and ask the routine procurement questions you’d expect: payment structures, delivery windows, specification requirements. They’re not trying to extract money in one hit. They’re building enough credibility that the sales team is comfortable moving them into onboarding.
4. A Blueprint That Isn’t One
Once the sales rep asks for technical parameters to finalise the quote, the attacker sends over an attachment: an SVG file styled as a project blueprint. Most endpoint security tools treat SVGs the same way they treat a JPEG or PNG, as a harmless image. The file sits untouched on the desktop until someone opens it in a browser, which is exactly what triggers the problem.
The Forensic Catch: Exposing the Code
Our engineering team escalated the file for review once it landed with us, and looked past the image layer to the raw code underneath.
SVGs aren’t static pictures. They’re written in XML, a text-based markup format, which means they can carry executable script inside what looks like a graphics file. Buried in the coordinate data, our team found heavily obfuscated JavaScript. Open the file in a browser and click on the blueprint, and that hidden code runs, kicking off browser-based smuggling techniques aimed at the device.
The company profile checked out. The wording was clean. Even the domain swap took a second look to catch. Expecting a sales manager to run forensic checks on every enquiry that comes through the contact form isn’t realistic, and it isn’t their job.
That’s really the point here: “we haven’t had a problem yet” isn’t a security posture. It’s the absence of one.
Shifting to Perimeter Defense
By the time an employee has opened a weaponised attachment, the odds have already shifted against you. Most EDR agents treat the local browser as a trusted process by default. The malicious script runs inside the browser’s own JavaScript sandbox, which means it can lift credentials and pull down further malware straight into RAM before anything on the endpoint flags it as unusual.
Stopping this kind of attack means cutting it off earlier, before your team is even in a conversation with the attacker.
-
Advanced Bot Protection (ABP): This combines intent-based detection, biometric signals and machine learning to fingerprint automated traffic at the browser level, so scripted submissions get isolated on your contact and quote pages before they reach a human inbox.
-
Client-Side Protection: This governs what JavaScript is allowed to run or transmit inside the browser session itself. Real-time execution controls neutralise this kind of local code exploit even if someone does open the file.
Your sales team’s job is chasing revenue, not screening for malware. If you want a clearer picture of where the gaps usually sit, it’s worth reading up on the common application security myths that leave businesses exposed like this. Contact us to discuss how we can help you protect your business.
Application Security Solutions | Contact us
Sign up for our newsletter | Imperva
