Phishing lure combining messenger brand with device-link verification phrase

Arnold Chan@slaz

•updated 2 days ago•0•0•1

Detects inbound phishing emails containing brand mentions for Signal, WhatsApp, or Telegram alongside lure phrases related to verification, 2FA, or device linking. The rule specifically filters for emails containing URLs while excluding messages originating from official domains associated with these services.