Spearphishing PDF via gappssmtp DMARC Strict Alignment Failure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects spearphishing emails delivered through Google Workspace infrastructure that fail DMARC strict alignment check. Specifically, this monitors instances where the DKIM signing domain is a gappssmtp.com subdomain that fails alignment with the envelope sender domain, while concurrently carrying a PDF attachment, consistent with known phishing campaign patterns.