LegionLoader Phishing Kit: Lorem Ipsum Latin Placeholder Text in PDF Lure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.