Scotiabank TOAD Phishing: HTML Attachment with .mp3.eml Dual-Extension

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•5

This rule detects highly suspicious email attachments that mimic voicemail notifications, specifically targeting Scotiabank users. It identifies emails with attachments named like 'v-mail_*.mp3.eml' or ending with '.mp3.eml' where the attachment's MIME type is 'application/html'. The rule also looks for specific subject line keywords related to Scotiabank, Interac, e-Transfer, unauthorized activity, or a specific monetary value ('3,000'), and checks for an approximate file size of 6000-9000 bytes, consistent with known phishing lures.