Deceptive MP3 File Type Mismatch (Scotiabank TOAD)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•4

Detects an email attachment file type mismatch where the filename contains 'mp3' to masquerade as an audio file, but the actual MIME type is HTML or EML. This technique was observed in a Scotiabank TOAD (Telephone-Oriented Attack Delivery) callback phishing campaign to trick users into opening interactive phishing pages.