Phishing Email DKIM+DMARC Fail with Invoice Theme and SaaS Redirect Links

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects inbound phishing emails that fail both DKIM and DMARC checks, contain invoice-themed subject lines, and include links pointing to known open-redirect infrastructure (holabrief.com or loopedin.io). This pattern is consistent with credential harvesting campaigns using multi-hop SaaS redirects.