A Real Thread, a Real Mailbox, One Swapped Button
ID: 907d310d-7913-5b34-9cfe-980144ba01b6
STIX ID: report--907d310d-7913-5b34-9cfe-980144ba01b6
Feed Name: IRONSCALES
Threat Score
A mid‑August 2026 phishing incident used a compromised vendor Microsoft 365 mailbox to send a voicemail playback notice layered on top of a genuine internal vendor support thread; authentication checks (SPF/DKIM/DMARC/ARC) all passed because the mail originated from the vendor tenant, while two call-to-action buttons redirected to an unrelated domain (reikongaku.com) that carried the malicious payload, leading to a manual report and quarantine of the mailbox.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.