Mexico's Tax Authority, Sent From a Yahoo Account

A high-confidence credential-harvesting phishing message in Spanish impersonated Mexico's tax authority, was sent from a legitimately authenticated Yahoo Japan consumer mailbox, included a small PDF containing a single link to an attacker-owned domain (dyxcyk.com, registered July 2025), and was scored by the detection platform at 90% for credential theft; the report provides IOCs (email, domain, URL, file hash), MITRE mappings (T1566.001, T1204.001, T1585.002), and recommendations to score asserted identity against sender domain class, measure domain dormancy, OCR and inspect attachment text, and treat unusual sending language as a signal.