Executive Summary
A high-severity Telephone-Oriented Attack Delivery (TOAD) campaign has been identified impersonating Scotiabank to target high-value corporate executives, specifically CFOs. The campaign utilizes highly authentic email templates claiming unauthorized $3,000 Interac e-Transfers, leveraging compromised but legitimate small-business domains (some registered as early as 2015) to bypass standard SPF and DMARC authentication checks.
The attack chain avoids traditional technical indicators like malicious URLs or malware droppers. Instead, it employs an HTML attachment disguised with an '.mp3.eml' extension that renders a fake voicemail notification. The primary goal is to coerce the recipient into calling a fraudulent toll-free number (1-800-472-6[XXX]) to 'resolve' the fake transaction. This method successfully moves the interaction to a voice channel, evading most network-based security controls and automated scanning tools.