Healthcare Sender Impersonation Invoice Phishing with DMARC Fail and SaaS Redirect

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.