High Severity

Attachment: Fake mobileconfig security update profile

Labels

Credential Phishing
Impersonation: Brand
Social engineering
Evasion
File analysis
Content analysis
XML analysis

Description

Detects .mobileconfig attachments that present themselves as an Apple 'Security Update' configuration profile but omit the PayloadContent section required for a legitimate profile. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.

References

No references.

Sublime Security
Created Sep 25th, 2026 • Last updated Sep 25th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .file_extension == "mobileconfig"
        and strings.icontains(file.parse_text(.).text,
                              '<key>PayloadDisplayName</key><string>Security Update '
        )
        and not strings.icontains(file.parse_text(.).text, 'PayloadContent')
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started