Browse Rules

Callback phishing via Zelle Service Abuse

Callback phishing campaigns have been observed abusing Zelle services to send fraudulent payment requests with callback phishing contents.

Callback phishing via Intuit service abuse

Callback phishing campaigns have been observed abusing Intuit Quickbooks services to send fraudulent invoices with callback phishing contents.

Callback phishing via Zoho service abuse

Callback phishing campaigns have been observed abusing Zoho Invoice services to send fraudulent invoices with callback phishing contents.

Callback phishing via calendar invite

Detects calendar invites containing callback phishing language in the DESCRIPTION or SUMMARY of the invite.

Attachment: Callback phishing solicitation via text-based file

Callback Phishing via a text-based file attachment and a short body and subject from an unknown sender.

Callback phishing via Google Meet

Detects Google Meet invitations that include callback phishing content in the body, impersonating brands like McAfee, Norton, PayPal, or Best Buy with purchase-related language and phone numbers to solicit victim contact.

Callback phishing via Adobe Sign comment

This rule inspects messages originating from legitimate Adobe Sign infrastructure, with content matching Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number.

Callback Phishing via Signable E-Signature Request

This rule inspects messages originating from legitimate Signable infrastructure, with content matching Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number.

Callback phishing via SignFree e-signature request

This rule inspects messages originating from legitimate SignFree infrastructure, with content matching Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number.

Callback phishing via Xodo Sign comment

This rule inspects messages originating from legitimate Xodo Sign infrastructure, with content matching Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number.

Callback phishing via DocuSign comment

This rule inspects messages originating from legitimate DocuSign infrastructure, with a DocuSign logo that match Callback Phishing criteria, in the body, requiring at least one brand name, as well as 3 matching Callback Phishing terms and a phone number.

Callback phishing via extensionless rfc822 attachment

This rule detects messages with an unknown file_type (extensionless) and a content_type of 'message/rfc822' containing an image file with Callback Phishing indicators.

Callback phishing: Social Security Administration fraud

Detects phishing attempts that impersonate the Social Security Administration, using a single PDF attachment containing specific fraud-related language and a callback number.

Callback phishing in body or attachment (untrusted sender)

Detects callback scams by analyzing text within images of receipts or invoices from untrusted senders.

Service abuse: Callback phishing via Microsoft Teams invite

Detects abuse of legitimate Microsoft Teams invites containing callback scam content, including brand references and financial transaction language with phone numbers.

Suspicious mailer received from Gmail servers

Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.

Callback phishing via Microsoft comment

Detects callback scam messages originating from legitimate Microsoft infrastructure but containing fraudulent content designed to trick recipients into calling scammer phone numbers. The message includes typical callback phishing language around purchases, payments, subscriptions, or support services along with embedded phone numbers, while passing Microsoft's authentication checks.

Callback phishing: SumUp infrastructure abuse

A fraudulent invoice/receipt found in the body of the message sent by exploiting SumUp's receipt email service.

Service abuse: Google Groups callback scam

Detects inbound messages originating from Google Groups that contain high-confidence callback scam content, identifying abuse of the legitimate service to distribute fraudulent callback requests.

Service abuse: WeTransfer callback scam

Detects callback scams originating from legitimate WeTransfer noreply address using natural language processing to identify high-confidence callback scam intent in the message body.

Callback phishing via Yammer comment

Detects callback scams sent through Yammer infrastructure containing suspicious payment-related keywords and phone numbers. The rule identifies messages with callback scam language patterns or multiple financial transaction terms combined with phone number patterns in the message body or subject line.

Service abuse: Microsoft Power BI callback scam

Detects callback scam content sent from the legitimate Microsoft Power BI service email address, indicating potential service abuse to distribute fraudulent callback solicitations.

Service abuse: Monday.com callback scam

Detects callback scam solicitations originating from Monday.com's notification system using natural language understanding to identify fraudulent callback language in the message body.

Service abuse: Google Calendar notification with callback scam language

Detects messages sent from Google's legitimate calendar notification service that contain callback scam language, indicating potential abuse of the calendar sharing feature to distribute fraudulent content.

Service abuse: PayPal manager account creation with callback scam indicators

Detects inbound messages abusing PayPal's noreply address with subjects about PayPal Manager user account creation that contain callback scam intent patterns identified through natural language analysis.