The Foxit eSign Email That Erased Foxit

An attacker created a Foxit eSign account impersonating Binance and sent fully authenticated e-sign notifications to four mailboxes at a US investment firm; embedded CSS that set table, tr, td and a button container to display:none removed Foxit’s table-based UI, leaving a div/grid-based Binance “Phone Number Updated” card that urged recipients to call a toll-free number—a phone-oriented callback phishing (TOAD) attack that bypassed reputation/URL engines and passed SPF/DKIM/DMARC.