High Severity

Attachment: Re-stamped invoice PDF with IRS references from external sender

Labels

BEC/Fraud

PDF

Optical Character Recognition

Description

Detects inbound messages from external senders that carry a PDF attachment generated with the MuhammaraJS or Hummus-Recipe PDF libraries, identified via embedded EXIF/producer metadata. These PDFs masquerade as outstanding invoice or payment follow-up notices and contain an embedded link pointing to irs.gov/FormW9, attempting to lend legitimacy to the fraudulent invoice by referencing an official IRS tax form. The pattern spans numerous unrelated sender domains and spoofed invoice subject lines, consistent with a shared PDF-generation toolkit used for business email compromise style lures.

References

No references.

Sublime Security

Created Oct 16th, 2026 • Last updated Oct 16th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        .file_type == "pdf"
        and (
          strings.icontains(beta.parse_exif(.).producer, 'MuhammaraJS')
          or strings.icontains(beta.parse_exif(.).creator, 'Hummus-Recipe')
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.parse_exif(.).fields, .key == "Source-Producer")
        and beta.parse_exif(.).page_count <= 4
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and regex.icontains(beta.ocr(.).text,
                            'irs\.gov/form',
                            'request for taxpayer',
                            'identification number and certification',
                            'form\s*w-?9\b'
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.