Executive impersonation invoice fraud via service-nowinc/domainlify domains

Ibrahim Saud@tektrix

•updated Sep 16, 2026•4•0•6

Detects emails from specific suspicious domains or senders masquerading as executive roles (CEO, CFO) that contain attachments with 'invoice' in the filename and subject lines indicative of urgent financial transactions (e.g., payment, wire transfer). This pattern is commonly associated with Business Email Compromise (BEC) and malicious document delivery.