Sublime-Message-sender Event ID 7000023

Sublime MQL (208)

• Attachment with VBA macros from employee impersonation (unsolicited) severity high
• Attachment: EML with link to credential phishing page severity high
• Attachment: Legal themed message or PDF with suspicious indicators severity medium
• Attachment: PDF bid/proposal lure with credential theft indicators severity medium
• Attachment: QR code link with base64-encoded recipient address severity high
• BEC with unusual reply-to or return-path mismatch severity high
• BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
• BEC/Fraud: Romance scam severity medium
• BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
• Benefits enrollment impersonation severity high
• Brand impersonation: AARP severity medium
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: ADP severity medium
• Brand impersonation: Amazon severity low
• Brand impersonation: Amazon Web Services (AWS) severity medium
• Brand impersonation: Amazon with suspicious attachment severity medium
• Brand impersonation: American Express (AMEX) severity low
• Brand impersonation: Apple severity high
• Brand impersonation: Aquent severity medium
• Brand impersonation: Aramco severity medium
• Brand impersonation: AuthentiSign severity medium
• Brand impersonation: Bank of America severity high
• Brand impersonation: Barracuda Networks severity medium
• Brand impersonation: Binance severity medium
• Brand impersonation: Blockchain.com severity medium
• Brand impersonation: Booking.com severity medium
• Brand impersonation: Canada Revenue Agency severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Charles Schwab severity medium
• Brand impersonation: Chase Bank severity high
• Brand impersonation: Coinbase severity high
• Brand impersonation: Dashlane severity medium
• Brand impersonation: DHL severity low
• Brand impersonation: DigitalOcean severity high
• Brand impersonation: Discord notification severity medium
• Brand Impersonation: Disney severity medium
• Brand impersonation: DocSend severity high
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
• Brand impersonation: DoorDash severity medium
• Brand impersonation: Dotloop severity medium
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Enbridge severity medium
• Brand impersonation: Exodus severity low
• Brand impersonation: Fake Fax severity medium
• Brand impersonation: Fastway severity medium
• Brand impersonation: FedEx severity low
• Brand impersonation: FINRA severity medium
• Brand Impersonation: Gemini Trust Company severity medium
• Brand impersonation: Github severity high
• Brand impersonation: GoDaddy severity medium
• Brand Impersonation: Google (QR Code) severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google using Microsoft Forms severity high
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Gusto severity medium
• Brand impersonation: Hulu severity medium
• Brand impersonation: Interac severity medium
• Brand impersonation: Internal Revenue Service severity high
• Brand impersonation: KnowBe4 severity medium
• Brand impersonation: LastPass severity high
• Brand impersonation: Ledger severity low
• Brand impersonation: LinkedIn severity medium
• Brand impersonation: Mailchimp severity medium
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Marriott with gift language severity medium
• Brand impersonation: McAfee severity medium
• Brand impersonation: Meta and subsidiaries severity medium
• Brand impersonation: MetaMask severity high
• Brand impersonation: Microsoft severity high
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft fake sign-in alert severity medium
• Brand impersonation: Microsoft Teams invitation severity high
• Brand impersonation: Morgan Stanley severity medium
• Brand impersonation: Navan severity medium
• Brand impersonation: Netflix severity low
• Brand impersonation: Okta severity medium
• Brand impersonation: OpenAI with payment issues severity high
• Brand Impersonation: PayPal severity medium
• Brand impersonation: PNC severity medium
• Brand Impersonation: Procore severity medium
• Brand impersonation: Quickbooks severity medium
• Brand impersonation: QuickBooks dispute notification severity high
• Brand impersonation: Ripple severity low
• Brand impersonation: Robert Half severity medium
• Brand impersonation: Robinhood severity medium
• Brand impersonation: SendGrid severity medium
• Brand Impersonation: ShareFile severity medium
• Brand impersonation: Sharepoint fake file share severity medium
• Brand Impersonation: Shein severity medium
• Brand impersonation: Silicon Valley Bank severity medium
• Brand impersonation: SiriusXM severity medium
• Brand impersonation: Social Security Administration severity medium
• Brand impersonation: Spotify severity low
• Brand impersonation: Square severity medium
• Brand impersonation: Squarespace severity medium
• Brand impersonation: State Farm severity medium
• Brand impersonation: Stellar Development Foundation (SDF) severity low
• Brand Impersonation: Stripe severity high
• Brand impersonation: Stripe notification severity medium
• Brand impersonation: Sublime Security severity high
• Brand impersonation: TikTok severity medium
• Brand impersonation: Toronto-Dominion Bank severity medium
• Brand impersonation: Trust Wallet severity high
• Brand impersonation: TurboTax severity low
• Brand impersonation: Twitter severity medium
• Brand impersonation: UK government Home Office severity high
• Brand impersonation: ukr[.]net severity medium
• Brand impersonation: United Healthcare severity medium
• Brand impersonation: UPS severity low
• Brand impersonation: USPS severity high
• Brand impersonation: Vanguard severity medium
• Brand impersonation: Vanta severity low
• Brand impersonation: Venmo severity medium
• Brand impersonation: Wells Fargo severity high
• Brand impersonation: WeTransfer severity high
• Brand impersonation: Wise severity high
• Brand impersonation: Wix severity medium
• Brand impersonation: Zoom (strict) severity medium
• Business Email Compromise (BEC) attempt from unsolicited sender severity medium
• Business Email Compromise (BEC) with request for mobile number severity medium
• Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
• Callback Phishing via Zoom comment severity medium
• Cloud storage impersonation with credential theft indicators severity medium
• Commonly abused sender TLD with engaging language severity medium
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• Credential phishing: Hyper-linked image leading to free file host severity medium
• Credential phishing: Onedrive impersonation severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Cyrillic vowel substitution in subject or display name from unknown sender severity medium
• Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
• Display name and subject impersonation using recipient SLD (new sender) severity medium
• Display Name Emoji with Financial Symbols severity low
• Display name impersonation using recipient SLD severity medium
• DocuSign impersonation via CloudHQ links severity medium
• DocuSign impersonation via spoofed Intuit sender severity high
• Employee impersonation with urgent request (untrusted sender) severity medium
• Employee impersonation: Payroll fraud severity high
• Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
• Fake request for tax preparation severity high
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
• Google presentation open redirect phishing severity medium
• Google share notification with suspicious comments severity high
• Headers: System account impersonation with empty sender address severity medium
• HTML smuggling containing recipient email address severity medium
• Impersonation using recipient domain (untrusted sender) severity medium
• Impersonation: Chrome Web Store policy severity low
• Impersonation: Employee using fabricated identity in initial contact severity high
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Impersonation: Legal firm with copyright infringement notice severity medium
• Impersonation: Recipient organization in sender display name with credential theft image severity medium
• Impersonation: Salesforce fake campaign failure notification severity medium
• Link to Google Apps Script macro via comment tagging severity medium
• Link: Adobe share from unsolicited sender severity medium
• Link: Adobe share with suspicious indicators severity high
• Link: HR impersonation with suspicious domain indicators and credential theft severity high
• Link: Job recruitment lure from unsolicited sender with suspicious hosting severity medium
• Link: Microsoft impersonation using hosted png with suspicious link severity medium
• Link: Multistage landing - Abused Google Drive severity high
• Link: Uncommon SharePoint document type with sender's display name severity medium
• QR Code with suspicious indicators severity high
• Reconnaissance: Short generic greeting message severity medium
• Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
• Sender name contains Active Directory distinguished name severity medium
• Service abuse: AppSheet infrastructure with suspicious indicators severity medium
• Service abuse: DocuSign notification with suspicious sender or document name severity medium
• Service Abuse: ExactTarget with suspicious sender indicators severity high
• Service abuse: File sharing impersonation with external SharePoint links severity medium
• Service abuse: GitHub notification with excessive mentions and suspicious links severity high
• Service Abuse: GoDaddy infrastructure severity medium
• Service Abuse: HelloSign share with suspicious sender or document name severity medium
• Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
• Service abuse: Substack credential theft with confusable characters and branded button redirects severity medium
• Service abuse: Suspicious Zoom Docs link severity low
• Sharepoint online with external recipients and external display name severity medium
• Spam: Attendee list solicitation severity low
• Spam: Commonly observed formatting of unauthorized free giveaways severity low
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Fake photo share severity low
• Spoofable internal domain with suspicious signals severity medium
• Subject and sender display name contains matching long alphanumeric string severity low
• Suspected cross-site scripting (XSS) found in subject severity medium
• Suspicious attachment with unscannable Cloudflare link severity medium
• Suspicious display name: Gmail sender with engaging language severity low
• Suspicious message with unscannable Cloudflare link severity medium
• Suspicious message with unscannable Vercel link severity medium
• Suspicious request for financial information severity high
• Suspicious sender display name with long procedurally generated text blob severity medium
• Suspicious subject with long procedurally generated text blob severity medium
• Vendor impersonation: Thread hijacking with typosquat domain severity high
• VIP / Executive impersonation (strict match, untrusted) severity high
• VIP / Executive impersonation in subject (untrusted) severity medium
• VIP Impersonation via Google Group relay with suspicious indicators severity high
• VIP impersonation with BEC language (near match, untrusted sender) severity medium
• VIP impersonation with invoicing request severity high
• VIP impersonation with urgent request (strict match, untrusted sender) severity high
• VIP impersonation with w2 request with reply-to mismatch severity high
• VIP local_part impersonation from unsolicited sender severity high
• X (Twitter) impersonation with credential phishing motives severity medium
• Xero infrastructure abuse severity medium
• Xero invoice abuse severity medium