The Email That Almost Looked Like Todd How one suspicious message reveals the most dangerous attack style of 2026
There's a moment every business professional has experienced. You glance at your inbox, you see a familiar name, and without thinking — you click.
That's not carelessness. That's human nature. And attackers have built an entire industry around it.
This week, one of our clients forwarded us an email that stopped us cold. On the surface, it looked routine — a message from "Todd Cardenas" with a document attached, timestamped 7:57 AM on a Thursday morning. Nothing alarming. The kind of email that gets opened between a first and second cup of coffee.
Except Todd didn't send it.
What the email was actually doing
The display name said Todd. But the real sender — buried in the headers that almost nobody reads — was adammiller@admillerinc.com. A domain with no prior relationship. A name that meant nothing. A sender Microsoft's own system quietly flagged with a warning: "You don't often get email from this address."
Most people dismiss that banner. Attackers know that too.
Attached to the email was an .ICS file. A calendar invite. It sounds harmless — the kind of thing you'd click to accept a meeting. But this one carried a long, randomized numeric filename that's a signature of automated attack toolkits designed to slip past security filters undetected.
Here's what happens when someone opens it: their calendar application doesn't just display the file. It processes it. Embedded inside can be links to credential-harvesting pages, auto-executing scripts, or silent redirects that establish a foothold on your network before you've even finished your morning emails.
This particular combination — spoofed identity, unfamiliar domain, calendar-file payload — is what security professionals call a Business Email Compromise attack. It was the number one cause of financial loss from cybercrime last year, responsible for billions in damages globally.
The three seconds that matter most
Here's what we tell every client: the moment between seeing an email and acting on it is the most important moment in your cybersecurity posture. Not the firewall. Not the endpoint detection. Those three seconds.
Before you click anything, ask yourself three questions:
Does the sender's email address match who they claim to be — not just the display name, but the actual domain? Did you expect this communication, or did it arrive without context? Is there any reason someone who knows you would send this type of file, from this address, right now?
If any of those answers feel uncertain, you don't click. You pick up the phone and call the person directly. Not reply to the email. Not send a Teams message that goes to the same compromised account. A phone call.
What BITbyBIT clients do differently
Since 1987, we've watched the threat landscape transform from floppy disk viruses to nation-state ransomware. But the most persistent attack vector hasn't changed: it's a message, it's urgent, and it's asking you to do something before you think too hard about it.
Our managed clients have three layers protecting them from exactly this scenario. SentinelOne's AI-driven endpoint detection flags malicious calendar payloads before they execute. Our security awareness training means their teams have seen this exact attack pattern in simulation — so when the real thing arrives, it feels familiar in the wrong way. And our dark web monitoring catches credential exposure early, before attackers can use it to make their spoofed emails even more convincing.
But none of that replaces the three-second rule.
The email that almost looked like Todd? It's sitting in a quarantine folder now. The client called us first. That call cost them thirty seconds.
The alternative could have cost them everything.
Is your team trained to catch what your filters miss? Start a conversation with BITbyBIT at info@bitxbit.com — we've been protecting businesses since before the internet was a threat surface.
