Forged Healthcare Sender Invoice Phishing with DKIM/DMARC Failures and SaaS Redirect

Ibrahim Saud@tektrix

•updated Jun 28, 2026•2•0•4

Detects network connection attempts or DNS queries to a set of specific domains ('holabrief.com', 'loopedin.io') that are known to be associated with suspicious activity or potential command and control infrastructure.