24,700 emails, 9,000 companies, nothing to detonate: the payload is a phone number

Divide the traffic by the calendar and the campaign runs at roughly 1,764 messages a day ^[9]. Spread over more than 9,000 organizations, that works out to fewer than three messages per organization across the whole fortnight ^[10]. For a gateway watching one company's mail, that is not a campaign. It is a couple of pieces of unremarkable financial marketing, arriving days apart, with no link and no attachment to render a verdict on ^[7].

The thinness looks deliberate rather than modest. A credential-harvesting page serves everyone who arrives at no extra cost to the operator. A callback number does not: someone has to answer and hold the conversation long enough to extract card details or move the victim into another attacker-controlled channel ^[5]. That staffing requirement caps how much mail is worth sending, which is a better explanation for 1,764 a day than a shortage of addresses ^[9].

What is missing from Check Point's account is the conversion rate. The post describes what a caller's data or payment details might be used for ^[5], but gives no count of recipients who actually dialed ^[12]. The 24,700 also counts only what was seen inside the estates Check Point monitors ^[1], which makes it a floor rather than a size. Twenty-four thousand messages that produced eleven victims and twenty-four thousand that produced eight hundred read identically in a headline and not at all alike in a fraud ledger.

The one durable artifact is the number itself, sitting in the message body as text the recipient is invited to call ^[2]. It is the only object the email stage and the voice stage have in common, which makes it the nearest thing here to a blockable indicator, and also something the sender can swap cheaply. Taking it out of service is not a mail-gateway action; the party that can disconnect a line is not the party filtering the inbox. That is the part that does not resolve with a better classifier. Check Point's own framing puts the visibility gap on the far side of the call ^[4], and its answer is to stop the message before the user engages ^[8]. Both of those can hold at once, and the result is still that the enforcement boundary for voice-completed phishing sits outside the product that detects the email.