An Italian SME receives what looks like a tax agency email titled 'F24 rebate withheld - action required within 24h'. The logo is perfect, the tone formal, the link goes to 'agenziaentrate-rimborsi.servizi-fiscali.cloud'.
The accountant follows the link, types corporate tax-portal credentials and an SMS OTP. Within 12 hours the criminals issue four delegations to a fake intermediary and exfiltrate VAT records. The national CERT had flagged the domain 72 hours earlier.
Forensic analysis showed the domain was registered five days before the attack on an offshore registrar, the headers showed SPF fail and missing DKIM, and the sending IP came from known bulletproof hosting. Mythos rebuilt the evidence chain for the criminal complaint.