Knight Office AiTM Phishing Kit - 'L' Substitution Lure + Self-Spoofing

Ankit Mehta@Secvyn

•updated Sep 3, 2026•1•0•2

This rule detects incoming emails that contain common phishing lure keywords or reference ID patterns in the subject line, combined with signs of email spoofing (same sender/recipient domain) or a failure in email authentication protocols (DKIM, SPF, or DMARC).