Two-Stage Bank Scam Splits the Link to Starve Scanners

This high-severity BEC phishing incident used a legitimate ServiceNow outbound mailbox to send a split-delivery email asking a supplier for bank documents and promising a follow-up link; the first email contained no links or attachments so a legacy gateway scored it clean, but behavioral detection identified the pattern (first-time external sender, high-value financial request, instruction to expect a separate message) and quarantined it before the second-stage payload arrived.