Medium Severity

Attachment: Malicious mobileconfig profile

Labels

Description

Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.

References

No references.

Sublime Security

Created Sep 29th, 2026 • Last updated Sep 29th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        .file_extension == "mobileconfig"
        and (
          strings.icontains(file.parse_text(.).text,
                            '10a30957-e16b-30bf-c00f-48e1e9a85069'
          )
          or .sha256 in (
            '783cdb7425fbc29f5e35801d38a4782040da7f50e74d78de4b56eaa532eda82a',
            'ee8f15128560c2b2b4ee242026b2a2880ee604fe8489abb999ac43c969cfcdce',
            '8c0013f6ee4fe229f567469ed3f1bdaf2ee6a7a4b39a04ed28df38fa25287dfb'
          )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.