Medium Severity

Credential phishing: AWS Lambda URL with recipient targeting

Labels

Credential Phishing
Free subdomain host
Social engineering
URL analysis
Content analysis

Description

Detects messages containing AWS Lambda URLs with the recipient's email address embedded in the fragment, indicating potential abuse of AWS Lambda services for targeted malicious activities.

References

No references.

Sublime Security
Created May 28th, 2026 • Last updated May 28th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and recipients.to[0].email.domain.sld == sender.email.local_part
and any(body.links,
        strings.icontains(.href_url.domain.domain, "lambda-url")
        and strings.icontains(.href_url.fragment, recipients.to[0].email.email)
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started