Email Subject Contains Normalized Recipient Name from External Domain

Shadows VMB@Vemorian_Mort

•updated Aug 22, 2026•17•0•37

Detects incoming emails from an external domain where the email subject contains the recipient's normalized local name. This is a common pattern for targeted phishing or 'CEO fraud' style attacks where the subject is crafted to mimic personalized or internal communications.