Malicious Settlement PDF File Name in Email Attachment

Ethan Andrews@eandrews

•updated Jun 15, 2026•4•0•15

Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.