Europol Doesn't Email You a Screenshot

Europol does not email you a screenshot of your own indictment. That single fact is the tell in a case our SOC (Security Operations Center) reviewed at the close of 2024, when a marine and recreational-goods manufacturer received a French-language message claiming to come from Europol's European Cybercrime Centre, known as EC3. The subject line demanded urgency in shorthand, AVIS.URG. The body of the email, however, said almost nothing worth scanning. Every word of the accusation lived inside a single picture.

When the Threat Lives Only in a Picture

The payload was a roughly 343KB PNG (Portable Network Graphics) file. Inside it sat the full theatrical production: a EUROPOL header, a document titled PROCES-VERBAL, and the accusation "Vous avez commis une infraction via internet," meaning "you have committed an offense over the internet." The image had been rasterized from a PDF using a conversion tool called Neevia PDF/IMG, which flattened structured text into flat pixels.

That flattening is the point. A content filter that parses text for threatening language, extortion keywords, or brand names finds nothing in this message, because the body carries no such text. The scare copy is not text at all. It is a bitmap. This is a deliberate evasion of the class MITRE ATT&CK catalogs as Obfuscated Files or Information, where an attacker hides the meaningful content in a form that inspection tooling does not natively read.

The framing was pure fear rather than fraud. There was no wire request, no invoice, and no monetary demand attached to the message. The goal was to panic a recipient into replying to a supposed prosecutor, a classic extortion opening that trades on the authority of a real law-enforcement body.

A Trusted Sender Turned Against Its Own Reputation

The most dangerous property of this attack had nothing to do with the image. It was the return address on the envelope. The message arrived from a real, fully authenticated French university mail account, almost certainly compromised or repurposed rather than freshly registered by the attacker.

Because it came from a genuine domain, every authentication check passed. SPF (Sender Policy Framework) passed. DKIM (DomainKeys Identified Mail) passed, signed by the university's own domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) passed under a p=none policy. Composite authentication passed, and the ARC (Authenticated Received Chain) seals were valid. To any gateway grading a sender on reputation and authentication, this message looked immaculate.

The Microsoft Digital Defense Report 2024 documents how heavily adversaries now lean on legitimate, trusted identities to slip past exactly this kind of reputation scoring. And the pattern maps to the broader shape of the year: the 2024 Verizon Data Breach Investigations Report found the human element present in 68 percent of breaches, which is precisely the surface a law-enforcement scare email is built to exploit. When the machine cannot find a signal, the attacker's plan is to make a person supply one.

The single contradiction the attacker could not launder away was the reply path. The message asked the recipient to correspond with a prosecutor at a public consumer mailbox, opt.ec3.eu@mailo[.]com. Europol does not run its casework out of a free mailo.com address. That mismatch between the claimed authority and the actual reply channel is the seam that behavioral detection is designed to catch.

Mapping the Attack to MITRE ATT&CK

The tradecraft lines up cleanly against three techniques:

• T1566, Phishing. A socially engineered message using a spoofed authority to provoke action. This is textbook phishing with a legal-threat pretext.
• T1566.001, Spearphishing Attachment. The operative payload was delivered as an image file attachment rather than in the body or via a link.
• T1027, Obfuscated Files or Information. Rasterizing the accusation into a PNG hides the content from text-based inspection, the defining move of this case.

Indicators of Compromise

All indicators are defanged. Do not interact with them.

How Defenders Catch a Payload With No Text

An empty body and a clean authentication record are not signals of safety. They are the profile of an evasive attack. Detection here has to shift from what the email says to how the email behaves.

Three behavioral signals stand out. First, the sender was a first-time correspondent for this organization, a university mail account with no prior relationship to a marine manufacturer. Second, the reply address diverged from both the sending domain and the claimed sender, the mailo.com mailbox posing as Europol. Third, the message was almost entirely a single embedded image with no meaningful body text, an anomaly in normal business mail. CISA's guidance on stopping the phishing attack cycle reinforces the same principle, that the highest-value interventions target the attacker's behavior and the human decision point, not just malicious content.

This is where Adaptive AI earns its place ahead of a legacy gateway. Themis, the Adaptive AI analyst, weighs sender relationship, reply-path mismatch, and structural anomalies together rather than waiting for a text string or a known-bad hash. Optical Character Recognition (OCR) can also read the accusation back out of the PNG, restoring the very text the attacker tried to hide from inspection. A gateway that grades this message on authentication alone waves it through, which is why augmenting a legacy gateway with behavior-aware analysis closes the exact gap this attack was built to exploit.

The takeaway is blunt. Real prosecutors do not open a case by emailing you a picture of your own charges from a free mailbox. When the threat lives only in an image and the sender's authentication is flawless, trust the behavior over the credentials.

See how Adaptive AI surfaces authenticated, image-only attacks that text scanners miss on the IRONSCALES platform.