Medium Severity

Attachment: Single-page PDF with S3-hosted HTML link

Labels

Credential Phishing

PDF

Description

Detects inbound messages containing a single-page PDF attachment that includes exactly one URL, which links directly to an HTML file hosted on an Amazon S3 bucket. This technique is commonly used to redirect recipients to credential harvesting pages while leveraging trusted cloud infrastructure to evade detection.

References

No references.

Sublime Security

Created Jul 16th, 2026 • Last updated Jul 16th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        .file_type == "pdf"
        // a single page pdf
        and beta.parse_exif(.).page_count == 1
        and any(file.explode(.),
                length(.scan.pdf.urls) == 1
                and any(.scan.pdf.urls,
                        strings.contains(.path, '.html')
                        and // links directly to a S3 bucket
                        .domain.root_domain == "amazonaws.com"
                        and strings.icontains(.domain.subdomain, "s3")
                )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.