Latin-Placeholder PDF Phishing Lure Targeting C-Suite via Generic Sender Display Name

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.