Invoice Phishing: Forged Healthcare Sender with DKIM Fail and DMARC Quarantine

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects potentially malicious invoice-themed emails by monitoring email gateway telemetry for a combination of failing email authentication checks (DKIM, SPF, DMARC) and domain mismatches, which are indicative of spoofing attempts.