Latin-Placeholder PDF Phishing via gasparinutrition.com gappssmtp.com DMARC Misalign
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
YARA-L
