The Hover Check Passed: Every Link Went to the Real Vendor

A high-severity vendor email compromise (business email compromise) targeted a diversified holding company using a lookalike domain (mackyacomm.com) registered 28 days earlier and two forged PDF bank-change documents. Links and signature mailto targets pointed to the genuine vendor and scanned clean, but PDF metadata inconsistencies (re-dated Chase letter, scanned 2019 document edited the morning of sending), contradictory bank/role/phone details, and threaded signature HTML indicated fraud; a human analyst flagged the messages as malicious. Indicators provided include the lookalike domain, specific CC addresses, and MD5 hashes of the two PDFs; recommended defenses are character-by-character domain checks, inspecting PDF creation/modification metadata, and phone verification of bank-change requests.