The Law Firm Document That Linked to a Cleaning Company
ID: 6fe3f0f4-b820-5764-953f-020259a09733
STIX ID: report--6fe3f0f4-b820-5764-953f-020259a09733
Feed Name: IRONSCALES
Threat Score
A targeted spearphishing email impersonating a UAE law firm successfully passed SPF/DKIM/DMARC and delivered a "Review Document" CTA that routed to a credential-harvesting page on a cleaning-company subdomain; the message used mismatched tooltip and To/From domains to masquerade as legitimate legal correspondence, triggered Microsoft SCL=5 and Themis quarantine actions, and was mapped to MITRE techniques T1566.002, T1036.005, and T1204.001.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.