Sublime Security medium experimental mql

Service abuse: PayPal manager account creation with callback scam indicators

Detects inbound messages abusing PayPal's noreply address with subjects about PayPal Manager user account creation that contain callback scam intent patterns identified through natural language analysis.

View Source

Detection Logic

type.inbound
and sender.email.email == "noreply@paypal.com"
and strings.icontains(subject.base,
                      "Creation of your PayPal Manager user account"
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("callback_scam", "cred_theft") and .confidence != "low"
)

Field Validations

Loading…

Comments (0)

Loading comments...