A textile SME is waiting for a 92,000 EUR payment from a French client. Days before the deadline, the client's accounts receivable receives what looks like an email from the Italian CEO with an updated invoice PDF and new IBAN 'due to a bank change'.
The payment goes to a UK IBAN owned by a money mule recruited online. The criminals had compromised commerciale@<company>.it a month earlier, read the threads with the client and picked the right moment. They used a lookalike domain with 'i' instead of 'l'.
Mythos analyzed the fraudulent email header: SPF fail, domain registered 11 days earlier, sending IP on an Asian VPS. PDF analysis showed it was generated from the same template as the real PDF but with modified Adobe metadata. The dossier enabled partial SWIFT recall and blocking 38% of the funds.