• Sublime Core Feed
Medium Severity

Brand impersonation: Zoom via HTML styling

Labels

Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis

Description

Detects messages impersonating Zoom by identifying HTML table cells with specific blue styling (rgb(11,92,255)) containing Zoom branding in header elements.

References

No references.

Sublime Security
Created Feb 27th, 2026 • Last updated Feb 27th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(html.xpath(body.html, '//tr/td[contains(@style, "rgb(11,92,255)")]/h1').nodes,
        strings.icontains(.display_text, "zoom")
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started