Scotiabank TOAD Phishing: HTML Attachment with .mp3.eml Dual-Extension

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.