Retired Brand, Real Signature: Extortion in a DMARC Gap

**Executive summary:** A shared mailbox received an extortion email that authenticated via SPF/DKIM for the vendor's current domain while displaying a legacy (pre-rebrand) From address, causing DMARC alignment to fail and delivery to continue (compauth=pass); the email contained five inline images of recycled third‑party personal‑injury documents presented as breach proof, there were no links or malware, and detection was made via contextual signals and Adaptive AI.