A Construction Bid Invitation Hid a Compromised Website Behind a Legitimate-Looking PDF Label
ID: bf1c3027-ca9d-5bad-bed3-2375606049d6
STIX ID: report--bf1c3027-ca9d-5bad-bed3-2375606049d6
Feed Name: IRONSCALES
Threat Score
A construction-industry themed phishing email used display-text deception—an anchor labeled as a bid-preview PDF that resolved to a compromised Brazilian media site—to perform credential harvesting. The message passed SPF/DKIM/ARC and used mass-BCC distribution; IRONSCALES Adaptive AI quarantined the message by detecting the mismatch between visible link text and actual URL, highlighting the need to verify link destinations against their display text and to treat mass-BCC vendor-style messages as suspicious.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.