Executive Summary
In mid-2026, a manufacturing sector target was subjected to a sophisticated phishing campaign that successfully bypassed traditional SPF, DKIM, and DMARC authentication checks. The attacker utilized display-name impersonation, where the visible sender name matched a trusted internal contact, while the actual mail originated from an unrelated, but authenticated, external domain (unrelated-domain[.]es). This technique exploits the visual design of mobile and desktop mail clients that often hide the true sender address from the end user.
The attack featured a low-urgency 'curiosity lure,' inviting the recipient to view personal photos via a single malicious link. The destination infrastructure relied on disposable domains registered only hours before the attack began, effectively evading reputation-based security filters. Despite passing all technical protocols, the threat was identified through behavioral analysis that detected the mismatch between the displayed identity and the originating infrastructure.