Medium Severity

BEC: Executive coaching vendor impersonation

Labels

BEC/Fraud

Impersonation: Brand

Social engineering

Content analysis

HTML analysis

Natural Language Understanding

Description

Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals.

References

No references.

Sublime Security

Created Jun 30th, 2026 • Last updated Jul 1st, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  strings.icontains(body.current_thread.text, "ezra", "hesion")
  or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
)
and strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'leadership development coach',
                      'coaching, leadership development',
                      'accounting & collections department',
                      'executive coach for emerging leaders',
                      'accounts receivable - coaching division'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Payment Information",
          "Request to View Invoice"
        )
        and .confidence == "high"
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.