Medium Severity

Body: AI-generated invoice template artifacts

Labels

Credential Phishing

BEC/Fraud

Social engineering

Spoofing

Natural Language Understanding

HTML analysis

Header analysis

Sender analysis

Description

Flags inbound messages where NLU classification of the thread text indicates medium or high confidence credential theft or BEC intent, and the message HTML contains comment artifacts characteristic of AI-generated invoice/billing templates (e.g. 'PDF icon', 'File row', 'Billing Table', 'CTA Button'). Messages from highly trusted sender domains are excluded unless they fail DMARC authentication.

References

No references.

Sublime Security

Created Aug 22nd, 2026 • Last updated Aug 22nd, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "bec") and .confidence in ("medium", "high")
)
// templated ai-generated comments
and any(html.xpath(body.html, '//comment()').nodes,
        regex.icontains(.raw,
                        'PDF icon|File row|Status \+ Reference|Billing Table|Invoice Info|CTA Button'
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.