Attachment: Re-stamped invoice PDF with IRS references from external sender

calendar Oct 16, 2026  ·
Share on: linkedin copy

Detects inbound messages from external senders that carry a PDF attachment generated with the MuhammaraJS or Hummus-Recipe PDF libraries, identified via embedded EXIF/producer metadata. These PDFs masquerade as outstanding invoice or payment follow-up notices and contain an embedded link pointing to irs.gov/FormW9, attempting to lend legitimacy to the fraudulent invoice by referencing an official IRS tax form. The pattern spans numerous unrelated sender domains and spoofed invoice subject lines, consistent with a shared PDF-generation toolkit used for business email compromise style lures.

Sublime rule (View on GitHub)

 1name: "Attachment: Re-stamped invoice PDF with IRS references from external sender"
 2description: "Detects inbound messages from external senders that carry a PDF attachment generated with the MuhammaraJS or Hummus-Recipe PDF libraries, identified via embedded EXIF/producer metadata. These PDFs masquerade as outstanding invoice or payment follow-up notices and contain an embedded link pointing to irs.gov/FormW9, attempting to lend legitimacy to the fraudulent invoice by referencing an official IRS tax form. The pattern spans numerous unrelated sender domains and spoofed invoice subject lines, consistent with a shared PDF-generation toolkit used for business email compromise style lures."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          and (
10            strings.icontains(beta.parse_exif(.).producer, 'MuhammaraJS')
11            or strings.icontains(beta.parse_exif(.).creator, 'Hummus-Recipe')
12          )
13          //
14          // This rule makes use of a beta feature and is subject to change without notice
15          // using the beta feature in custom rules is not suggested until it has been formally released
16          //
17          and any(beta.parse_exif(.).fields, .key == "Source-Producer")
18          and beta.parse_exif(.).page_count <= 4
19          //
20          // This rule makes use of a beta feature and is subject to change without notice
21          // using the beta feature in custom rules is not suggested until it has been formally released
22          //
23          and regex.icontains(beta.ocr(.).text,
24                              'irs\.gov/form',
25                              'request for taxpayer',
26                              'identification number and certification',
27                              'form\s*w-?9\b'
28          )
29  )  
30attack_types:
31  - "BEC/Fraud"
32tactics_and_techniques:
33  - "PDF"
34  - "Social engineering"
35  - "Impersonation: Brand"
36detection_methods:
37  - "Exif analysis"
38  - "File analysis"
39  - "Optical Character Recognition"
40id: "27d941d3-d589-5c74-816f-07d7b14315ac"
to-top