The Geek Squad Invoice That Forgot Which Brand It Was Pretending to Be

An image-only callback phishing (TOAD) campaign targeted a healthcare organization with a JPEG 'Geek Squad' renewal invoice urging recipients to call a listed phone number within 24 hours; OCR revealed a brand mismatch ('Geek Squad' header, 'Windows Defender' footer) indicating template reuse across campaigns. The message originated from [email protected] and was relayed via a FortiMail cloud gateway that broke SPF while DKIM/DMARC passed; Themis detection flagged it at 90% confidence and the report provides IoCs (relay IP 148.230.56.132, attachment 34GE1RIEDYLJ.jpg, callback number 828-424-4048, invoice and reference token) and MITRE mappings.