A Fake Scotiabank Voicemail Was Actually an HTML File Asking You to Call an Attacker

An attacker leveraged a compromised decade-old GoDaddy-hosted small-business email account to send a Scotiabank-branded fraud alert to a CFO, including an HTML attachment disguised as an MP3 voicemail and a US toll-free number as the sole call-to-action; SPF and DMARC passed so the message appeared legitimate, no malicious links or payloads were present, and the campaign's objective was to trick the recipient into calling an attacker-controlled phone line to stop a purported $3,000 Interac e-Transfer.