Phishing delivering ZIP-wrapped LNK disguised as PDF (VelvetCake lure)

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects incoming spearphishing emails that contain a ZIP archive attachment. The rule alerts if the archive contains an LNK file with a double extension (e.g., .pdf.lnk) or if the email subject contains specific social engineering lures related to food pricing or peace negotiations.