Medium Severity

Impersonation: HR administrative center PDF password lure

Labels

Credential Phishing

Impersonation: Brand

Description

Detects inbound messages impersonating an internal HR administrative center or company HR department, referencing payroll, policy, or compliance updates. Messages include a numeric case-style identifier in the subject and reference a password-protected PDF attachment, with the decryption password embedded in the body text. Sender display names often use combining diacritical marks or long numeric strings to evade detection, and sending domains are typically unrelated, compromised, or lookalike infrastructure abusing legitimate-looking company names.

References

No references.

Sublime Security

Created Aug 28th, 2026 • Last updated Aug 28th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  (
    (
      strings.contains(body.current_thread.text, '{COMPANYNAME}')
      and strings.contains(body.current_thread.text, '{PDFKEY}')
    )
    and (
      strings.contains(subject.base, '{NUMBER10}')
      or strings.contains(sender.display_name,
                          '{COMPANYNAME}',
                          '{RANDSTRING25}',
                          '{NUMBER10}'
      )
    )
  )
  or (
    (
      regex.icontains(body.current_thread.text,
                      'your_.{1,20}-pdf password\s*=>'
      )
      or regex.icontains(subject.base, 'hr administrative center-\d')
    )
    and (
      regex.count(sender.display_name, '[\x{0300}-\x{036F}]') >= 3
      or regex.icontains(sender.display_name, '\|-1\d{8,}')
    )
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.