---
title: "The Always Dangerous Combination Phishing Attack | DuoCircle"
description: "What’s more dangerous than a phishing attack that uses a social engineering tactic to get you to click?"
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/"
---

Quick Answer

InfoSecurity Magazine reported a phishing wave that combines two social engineering hooks: COVID-themed CVs and fake medical leave forms. Sample subject lines like "the following is a new Employee Request Form for leave within the FMLA" and filenames like "COVID-19 FLMA CENTER.doc" carry IcedID or TrickBot banking trojans. The attack is harder to detect than a typical phishing link because the malicious payload is in the attached document, not a URL, and many anti-phishing tools only inspect links. Multiple sender domains are rotated to dodge basic filters. Defenses: email security that scans attachments as well as links, sandboxing for documents with macros, and blocking the message at the gateway rather than relying on the recipient. Cloud-based filtering removes the email before any user sees it.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20Always%20Dangerous%20Combination%20Phishing%20Attack&url=undefined%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F&title=The%20Always%20Dangerous%20Combination%20Phishing%20Attack "Share on Reddit") [ ](mailto:?subject=The%20Always%20Dangerous%20Combination%20Phishing%20Attack&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F "Share via Email") 

![Phishing Attack](https://media.mailhop.org/duocircle/images/2020/06/spf-record-tester-3478.jpg) 

_What’s more dangerous than a phishing attack that uses a social engineering tactic to get you to click?_ How about a **phishing attack** that uses a combination of TWO social engineering tactics to get you to click? And that’s exactly what was detected this week according to [InfoSecurity Magazine](https://www.infosecurity-magazine.com/news/phishers-hide-covid19-malware-cvs/).

[![Social Engineering](https://media.mailhop.org/duocircle/images/2020/06/spf-permerror-3698.jpg)](https://media.mailhop.org/duocircle/images/2020/06/spf-permerror-3698.jpg)

In this case, the two [social engineering](/phishing-protection/social-engineering-is-a-growing-threat/) tactics are phishers hiding **COVID-19 malware** in both CVs (curriculum vitae or resumes) AND medical leave forms. According to the article, “_Cyber-criminals are taking advantage of the evolving jobs market and employee health situation under COVID-19 to disguise malware in various emailed documents_. The phishing campaigns spotted center around spoofed CVs and medical leave forms.”

From [Tech Times](https://www.techtimes.com/articles/250193/20200609/hackers-new-phishing-scam-uses-resume-and-medical-leave-emails-to-hide-covid-19-malware.htm), “Checkpoint reported that the hackers are sending files with names like _COVID-19 FLMA CENTER.doc_ using emails with subjects such as ‘the following is a new Employee Request Form for leave within the FMLA’.”

_These types of attacks, which incorporate a malicious document, are more difficult to detect than standard phishing attacks which use a malicious link embedded in the email and link to a **phishing website**_. In this case, “the payload is info-stealing banking Trojans like Icedid or Trickbot. _Different sender domains are used to try and trick email filters_.”

[![Phishing Protection](https://media.mailhop.org/duocircle/images/2020/06/smtp-service-1273.jpg)](https://media.mailhop.org/duocircle/images/2020/06/smtp-service-1273.jpg)

The reason these types of phishing attacks are more difficult to detect is because many of the **anti-phishing products** on the market today ONLY look for malicious embedded links and expect some other security tool to detect malicious attachments. But, that’s not true for [Phishing Protection](/email/phishing-protection) from DuoCircle.

Phishing Protection from [DuoCircle](/) is _**cloud-based email security** with real-time link click protection AND malicious attachment blocking_. Not only does it detect both types of phishing attacks, but because it’s cloud-based, it blocks dangerous emails altogether. _That means phishing emails never even make it into your inbox_. Now that’s how you protect yourself from phishing attacks. _You certainly can’t click on something you never see_.

Since Phishing Protection is cloud-based, there’s no hardware to buy, no software to buy and nothing to configure. _It also means that you don’t have to give up your email service provider to use it_. **Phishing Protection** works seamlessly with all major email providers. And _Phishing Protection takes about 10 minutes set up and only costs pennies per user per month_.

For a limited time, you can try Phishing Protection for **free for 60 days**. No credit card required. Get it before hackers find a new social engineering tactic to trick you into clicking.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F) [ ](https://twitter.com/intent/tweet?text=The%20Always%20Dangerous%20Combination%20Phishing%20Attack&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fthe-always-dangerous-combination-phishing-attack%2F) Copy 

Related Articles

- [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg)  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)
- [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg)  10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)
- [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg)  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)
- [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg)  7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Always Dangerous Combination Phishing Attack","description":"What’s more dangerous than a phishing attack that uses a social engineering tactic to get you to click?","url":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/","datePublished":"2020-06-25T22:10:58.000Z","dateModified":"2025-05-22T17:55:32.000Z","dateCreated":"2020-06-25T22:10:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/"},"articleSection":"phishing-protection","keywords":"","wordCount":411,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/06/spf-record-tester-3478.jpg","caption":"Phishing Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"The Always Dangerous Combination Phishing Attack","item":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"The Always Dangerous Combination Phishing Attack","item":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Always Dangerous Combination Phishing Attack","description":"What’s more dangerous than a phishing attack that uses a social engineering tactic to get you to click?","url":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/","datePublished":"2020-06-25T22:10:58.000Z","dateModified":"2025-05-22T17:55:32.000Z","dateCreated":"2020-06-25T22:10:58.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/the-always-dangerous-combination-phishing-attack/"},"articleSection":"phishing-protection","keywords":"","wordCount":411,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/06/spf-record-tester-3478.jpg","caption":"Phishing Attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```