Authenticated, Unbranded, and Nothing to Block

A targeted callback-phishing (vishing) campaign abused a compromised, long-established webmail account to send authenticated emails that used Cyrillic homoglyphs in the display name and an 822-pixel spacer to display two different messages: a visible card prompting a callback number and a below-the-fold impersonation of a state agency with real contact details. The only payloads are telephone numbers (tel: links); there are no malicious links, attachments, or attacker-owned infrastructure, which circumvents traditional URL/domain/file-based controls. Detection relied on content analysis and community signals rather than sender reputation; recommended actions include treating callback numbers as IOCs, verifying any claimed contact-change through known channels, and not equating authentication passes with content trustworthiness.