Abnormal Security detected one of the campaign’s attack emails that masqueraded as an internal notification from the recipient’s company by using spoofing techniques to disguise the sender address.
Source: cyware.com