NDA lure phishing via WeTransfer link and lookalike domain

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects phishing emails associated with the 'GhostCode' campaign, which uses an NDA or Supplier NDA Agreement pretext combined with WeTransfer links. The rule identifies suspicious emails by correlating the lure content with additional indicators such as specific lookalike sender domains, VoIP contact numbers, hardcoded ZIP passwords, or HTML attachments.