Spoofed internal-domain phishing with file-sharing lure targeting leadership

Arnold Chan@slaz

•updated Sep 5, 2026•0•0•1

Detects Direct Send bypass (null envelope + internal-domain spoof) using a file/document-sharing lure aimed at leadership. Tightened: added inbound-direction and auth-failure requirements (was previously missing any authentication check, so legitimate SharePoint/OneDrive-style sharing notifications from real internal senders could have matched), delivered-only filter, and case-insensitive recipient/job-title join.