• Sublime Core Feed
High Severity

Link: Apple App Store link to apps impersonating AI adveristing

Description

Detects messages containing links to Apple App Store apps that impersonate popular AI services (OpenAI, ChatGPT, Meta, Gemini) and are categorized as advertising or management tools offered for free.

References

No references.

Sublime Security
Created Mar 4th, 2026 • Last updated Mar 4th, 2026
Source
type.inbound
and any(filter(body.current_thread.links,
               .href_url.domain.domain in ('apps.apple.com')
        ),
        // testflight = <script name="schema:software-application" type="application/ld+json">
        // apps.apple.com = <script id="software-application" type="application/ld+json">
        any(html.xpath(ml.link_analysis(.).final_dom,
                       '//script[@id="software-application"][@type="application/ld+json"]'
            ).nodes,
            // extract just the value of this node and parse it as json
            any([
                  "openai",
                  "openal",
                  "open ai",
                  "open al",
                  "chatgpt",
                  "meta",
                  "gemini"
                ],
                strings.icontains(strings.parse_json(regex.iextract(..raw,
                                                                    '<script id="software-application" type="application/ld\+json">\s*(?P<app_overview>.*)\s+</script>'
                                                     )[0].named_groups["app_overview"]
                                  )["name"],
                                  .
                )
            )
            and regex.icontains(strings.parse_json(regex.iextract(.raw,
                                                                  '<script id="software-application" type="application/ld\+json">\s*(?P<app_overview>.*)\s+</script>'
                                                   )[0].named_groups["app_overview"]
                                )["name"],
                                '\b(?:suite|ads?|advert|manager?|campaigns?)'
            )
            and strings.parse_json(regex.iextract(.raw,
                                                  '<script id="software-application" type="application/ld\+json">\s*(?P<app_overview>.*)\s+</script>'
                                   )[0].named_groups["app_overview"]
            )["offers"]["category"] == "free"
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started