Medium Severity

Credential Phishing: Bitcoin portfolio confirmation

Labels

Credential Phishing

BEC/Fraud

Social engineering

Content analysis

Natural Language Understanding

Header analysis

Description

Detects inbound messages that combine bitcoin/BTC terminology with portfolio or balance confirmation language, alongside at least two credential-harvesting indicators such as references to a web portal, customer ID, or password. The rule further requires the NLU classifier to flag the message with credential theft, advance fee, or BEC intent, and excludes messages from senders on high trust root domains that pass DMARC authentication.

References

No references.

Sublime Security

Created Aug 24th, 2026 • Last updated Aug 27th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  strings.icontains(body.current_thread.text, "btc", "bitcoin")
  or regex.icontains(body.current_thread.text, 'pass[\s-]?word')
)
and 2 of (
  strings.icontains(body.current_thread.text, "portfolio"),
  strings.icontains(body.current_thread.text, "confirm your balance"),
  strings.icontains(body.current_thread.text, "web portal"),
  strings.icontains(body.current_thread.text, "customer id"),
  strings.icontains(body.current_thread.text, "login to confirm")
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "advance_fee", "bec")
)
// and the sender is not from high trust sender root domains
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.