DocMagic Impersonation Phishing Campaign Link Click

Information hacker@Informationhacker

•updated Feb 10, 2026•9•0•85

This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.