Three Brands, One Lure: A Chase 'Secure Message via Virtru' That Actually Came From LinkedIn

Phishing campaign impersonated JPMorgan Chase using a pixel-accurate "secure message via Virtru" template while the actual From header was [email protected] and CTAs used Mimecast URL-wrapping that resolved toward chase.com; the multi-brand mismatch (brand shown, claimed provider, and sender) and stale canned content exposed credential-harvesting intent. IRONSCALES Themis classified it as phishing (90% confidence), listed IOCs, mapped MITRE techniques (T1566.002, T1656, T1036.005, T1204.001), and recommended identity-consistency checks, link unwrapping, and out-of-band verification.