Scotiabank TOAD Phishing: HTML Attachment with Toll-Free Callback and Interac Lure

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects inbound email events that impersonate Scotiabank, contain financial urgency lures related to Interac e-Transfers, and include suspicious HTML attachments or .eml files. The rule specifically looks for HTML attachments or .eml files with specific naming conventions ('v-mail_' prefix or '.mp3.eml' suffix) and a file size between 7KB and 8KB, or any HTML attachment. It also checks for sender display name impersonation of Scotiabank while the sender's actual domain is not scotiabank.com.