TrendLabs: Phishing Campaign uses Hijacked Emails to Deliver URSNIF by Replying to Ongoing Threads

Figure 2. Comparison between the malicious email and a legitimate one. Note the difference in language and the changed signature

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/