Operation DoppelBrand: AI-Assisted Executive Impersonation Invoice Fraud

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•3

This rule detects email-based business fraud (BEC) targeting the organization, specifically looking for executive impersonation paired with financial lure terminology and sender domain mismatches. It utilizes both a blocklist of known fraudulent sender indicators (domains and addresses) and a heuristic approach analyzing discrepancies between the envelope sender domain and the header sender domain combined with executive titles in display names and invoice-related keywords.