First-Contact Invoice Phishing with Auth Failures Targeting Multiple Mailboxes

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•1

Detects potential invoice-themed phishing campaigns by identifying inbound emails that simultaneously target multiple recipients from senders with whom the organization has no prior communication history. The detection specifically flags emails with authentication failures (DKIM, SPF, or ARC) in the subject line, which is a common pattern for phishing attacks attempting to bypass reputation filters using aged domains.