Sublime Security high experimental mql

Credential theft: Gophish abuse with hidden tracking image

Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.

View Source

Detection Logic

type.inbound
and (
  strings.icontains(body.html.raw,
                    '<img alt='''' style=''display: none'' src='''
  )
  or strings.icontains(body.html.raw, 'img alt="" style="display: none" src="')
)
and strings.icontains(body.html.raw, '/track?rid=')

Field Validations

Loading…

Comments (0)

Loading comments...