The Attachment Was Not a Payload. It Was the Second Beacon.

A phishing analysis describing a voicemail-styled 847-byte attachment named Voicemail_XXXXXXXXXX.mp3.mp3 that contained HTML one-pixel image references pointing at a mainstream provider's /tr/op/ open-tracking endpoint, acting as an attachment-resident beacon distinct from a separate body beacon; the file included truncated MPEG headers (offsets 671 and 805) that proved non-playable, authenticated clean by automated scanners (SPF/DKIM/DMARC and attachment triage) but was identified as malicious by a human analyst. Indicators provided include filename, MD5 hashes, URL path behavior, sender and landing domains, and specific file offsets; recommended mitigations are to treat small attachments with declared-type/size mismatches as unresolved, extract QR codes from inline parts, and count outbound requests per artifact.