Medium Severity

Link: Credential phishing with cloaked content

Labels

Credential Phishing

Evasion

Social engineering

URL analysis

HTML analysis

Natural Language Understanding

Content analysis

Description

Detects emails containing a small number of links where the rendered page content is cloaked: the visible display text is classified as credential theft intent with a security/authentication theme, while the underlying page's full text is classified as benign and unrelated to security topics. The mismatch, combined with a Cloudflare Insights beacon script in the page's accessed URLs, indicates an evasive technique designed to disguise a credential harvesting page from automated analysis while presenting a convincing login-themed lure to the victim.

References

No references.

Sublime Security

Created Oct 8th, 2026 • Last updated Oct 8th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
        and length(ml.link_analysis(.).final_dom.inner_text) > length(ml.link_analysis(.
                                                                      ).final_dom.display_text
        )
        and length(ml.link_analysis(.).final_dom.links) == 0
        and length(ml.link_analysis(.).final_dom.display_text) < 100
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents,
                .name == 'cred_theft' and .confidence != 'low'
        )
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).topics,
                .name == 'Security and Authentication' and .confidence != 'low'
        )
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.inner_text).intents,
                .name == 'benign' and .confidence != 'low'
        )
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.inner_text).topics,
                .name not in ('Security and Authentication')
        )
        and any(ml.link_analysis(.).unique_urls_accessed,
                .domain.domain == "static.cloudflareinsights.com"
                and strings.contains(.path, "/beacon.min.js/")
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.