Quarantine authenticated phishing by campaign fingerprint

At the packet’s October 18, 2026 cutoff, the reported pharmaceutical phishing messages had passed SPF, DKIM, and DMARC because attackers used a compromised legitimate WordPress/Exim host.

Those checks authenticated control of the sending infrastructure, not the message’s intent or the safety of its linked MSI.

Delivery volume and recipient impact were still unknown, making immediate campaign-scoped quarantine and retrospective full-header searching necessary to identify delivered copies and possible endpoint exposure.

Mail-gateway and security-operations teams handling the reported pharmaceutical phishing campaign are affected because SPF, DKIM, and DMARC success can allow these messages to appear authenticated despite the compromised WordPress/Exim source.

Recipients of messages matching X-Source-Dir: /wp-includes/sitemaps/geouzds/rjt1buw/ndztbpc and the local Exim submission hop require investigation to determine whether they opened the linked MSI.

Endpoint responders are affected when MSI execution is found because those endpoints require escalation. Administrators of the compromised legitimate WordPress/Exim host face misuse of their authorized mail infrastructure.

The packet identifies no WordPress or Exim versions, so it does not support a version-based affected population.

Support — The identity architect’s specialist analysis recommends quarantining messages with X-Source-Dir: /wp-includes/sitemaps/geouzds/rjt1buw/ndztbpc and the local Exim submission hop regardless of authentication results, followed by a full-header search, delivery enumeration, and recipient investigation.

Support — The moderator’s synthesis explains that SPF, DKIM, and DMARC success showed use of an authorized signing system on the compromised WordPress/Exim host; it did not establish that the legal lure or linked MSI was safe.

Support — The final synthesis is recorded by the evidence audit as aligning with the same quarantine and retrospective-investigation path.

Evidence gap — A separate audit finding says the exact fingerprint lacks independent corroboration because the primary campaign report and original message headers are absent.

The identity architect identified the immediate control: quarantine messages carrying the reported X-Source-Dir: /wp-includes/sitemaps/geouzds/rjt1buw/ndztbpc and local Exim submission fingerprint, then search full headers and investigate the linked MSI.

The moderator resolved the central trust question by explaining that SPF, DKIM, and DMARC authenticated infrastructure controlled by the attacker, not the message’s intent. The decision scout converted that reasoning into a campaign-specific operational action.

The evidence audit found consistent support for the action but identified a material enrichment gap: the packet lacks the primary campaign report and original headers needed to corroborate the exact fingerprint independently.

The boundary assessment found the action safe when described as reported and limited to this pharmaceutical phishing campaign. No matching prior decision was found, and the arbiter selected a new record because the corroboration gap did not block the narrowly qualified response.