Email apparently from Manager <email@example.com> - Invoice mistake:
Hello victim email address
Just want to tell you that there is a mistake in this invoice we received from you. I'm providing the copy of it as well as the corrected one below. So, please send me an updated invoice at your earliest convenience.
Click here for details information
Manager Taylor Adam
Phishing link hidden in the content of the message: http: / / invoice0801.2amasonaws.download/read/document/am9obi44bHVlQGdtYWlsLmNvbQ==
Received: from smtpweb126.aruba.it (smtpweb126.aruba.it. [22.214.171.124])
Received: from 899C48.swisscom.com ([126.96.36.199])
Subject: Invoice mistake
From: Manager <firstname.lastname@example.org>
Date: Mon, 15 Jan 2018 15:54:01 +00Originating IP:
CasablancaCountry of Origin:
MoroccoNote: swisscom.com is a genuine company, spoofed in this case. The real Swisscom has nothing to do with the fraud/phishing attempt.