High Severity

Brand impersonation: Fake procurement/RFQ PDF from energy and industrial companies

Labels

BEC/Fraud

Impersonation: Brand

PDF

Social engineering

Image as content

Optical Character Recognition

File analysis

Content analysis

Description

Detects inbound PDF attachments impersonating well-known energy and industrial companies (Neste, TotalEnergies, Vattenfall, MOL Group, Unilever, Shell, Waldinger, Novo Nordisk) using fabricated procurement orders, requests for quotation, or supply chain solicitation documents. OCR is used to identify specific branding, addresses, and keywords embedded in these fraudulent PDF templates.

References

No references.

Sublime Security

Created Jun 25th, 2026 • Last updated Jun 25th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(attachments, .file_extension == "pdf"),
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        (
          strings.icontains(beta.ocr(.).text, "Neste Niederlande")
          and strings.icontains(beta.ocr(.).text, "Antarcticaweg 185")
          and strings.icontains(beta.ocr(.).text,
                                "NESTE PROCUREMENT ORDER",
                                "This is not a Purchase Order"
          )
        )
        or (
          strings.icontains(beta.ocr(.).text, "TotalEnergies Tower")
          and strings.icontains(beta.ocr(.).text, "Louisiana")
          and strings.icontains(beta.ocr(.).text, "SUPPLY CHAIN MANAGEMENT")
        )
        or (
          strings.icontains(beta.ocr(.).text, "Vattenfall")
          and strings.icontains(beta.ocr(.).text, "Hoekenrode 8")
          and strings.icontains(beta.ocr(.).text, "SUPPLY CHAIN MANAGEMENT")
        )
        or (
          strings.icontains(beta.ocr(.).text, "MOLGROUP", "MOL Ceská")
          and strings.icontains(beta.ocr(.).text, "Purkynova 2121/3")
          and strings.icontains(beta.ocr(.).text,
                                "REQUEST FOR PROPOSAL",
                                "This is not a Purchase Order"
          )
        )
        or (
          strings.icontains(beta.ocr(.).text,
                            "219 NORTH ROCKS ROAD",
                            "100 Victoria Embankment",
                            "WEENA 455"
          )
          and strings.icontains(beta.ocr(.).text,
                                "SUPPLY CHAIN MANAGEMENT",
                                "COMPULSORY BIDDERS MUST QUOTE",
                                "INVITATION TO TENDER",
                                "UNILEVER SUPPLY CHAIN RFQ"
          )
        )
        or (
          strings.icontains(beta.ocr(.).text, "Shell USA")
          and strings.icontains(beta.ocr(.).text, "150 N Dairy Ashford Road")
          and strings.icontains(beta.ocr(.).text,
                                "Public Tender Documentation",
                                "This is not a Purchase Order"
          )
        )
        or (
          strings.icontains(beta.ocr(.).text, "Waldinger Corporation")
          and strings.icontains(beta.ocr(.).text, "6200 Scout Trail")
          and strings.icontains(beta.ocr(.).text,
                                "REQUEST FOR QUOTATION",
                                "This is not a Purchase Order"
          )
        )
        or (
          strings.icontains(beta.ocr(.).text,
                            "NOVO NORDISK",
                            "nordisksourcingeu.com"
          )
          and strings.icontains(beta.ocr(.).text, "CARRE MICHELET")
          and strings.icontains(beta.ocr(.).text,
                                "COMPULSORY BIDDERS MUST QUOTE",
                                "This is not a Purchase Order"
          )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.