Attachment: Fake lawyer & sports agent identities

calendar Jan 26, 2026  ·
Share on: linkedin copy

Detects messages containing attachments or content that reference known fake identities used in FC Barcelona scams, including fake lawyer Michael Gerardus Hermanus Demon and sports agents with the surname Giuffrida. The rule examines EXIF metadata, OCR text from attachments, and message body content for these specific identity markers.

Sublime rule (View on GitHub)

 1name: "Attachment: Fake lawyer & sports agent identities"
 2description: "Detects messages containing attachments or content that reference known fake identities used in FC Barcelona scams, including fake lawyer Michael Gerardus Hermanus Demon and sports agents with the surname Giuffrida. The rule examines EXIF metadata, OCR text from attachments, and message body content for these specific identity markers."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(attachments) == 1
 8  and beta.parse_exif(attachments[0]).creator == "Gabriele Giuffrida"  
 9attack_types:
10  - "BEC/Fraud"
11tactics_and_techniques:
12  - "Impersonation: VIP"
13  - "Social engineering"
14detection_methods:
15  - "Content analysis"
16  - "Exif analysis"
17  - "File analysis"
18  - "Optical Character Recognition"
19id: "7d3a2478-a373-50d6-97bb-2dd1c3f710f7"
to-top