How we spotted it: A Silicon Valley Bank phishing attempt

Expel describes a phishing campaign that leverages the Silicon Valley Bank collapse to perpetrate payment counterparty fraud and harvest credentials: attackers sent spoofed emails (impersonating SVB/DocuSign), used malicious domains and a fake customer login page to capture account credentials, and aimed to redirect funds. The SOC detected the activity using a custom YARA rule, email header/SPF analysis, and IP checks, prioritized the alert for investigation, and expects more similar phishing attempts in the near term.