High Severity

Link: Credential phishing with obfuscated JavaScript redirect

Labels

Credential Phishing

Open redirect

Evasion

Scripting

Social engineering

Natural Language Understanding

URL analysis

Javascript analysis

Description

Flags inbound messages where the current thread contains between 1 and 9 links and NLU classification identifies credential theft intent with at least medium confidence. Additionally requires that aggressive link analysis reveal a redirect chain containing a query parameter with an obfuscated JavaScript payload that uses an onerror handler combined with atob and decodeURIComponent to dynamically redirect the browser, a technique commonly used to evade static URL scanning while ultimately routing victims to a credential harvesting page.

References

No references.

Sublime Security

Created Aug 21st, 2026 • Last updated Aug 21st, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and 0 < length(body.current_thread.links) < 10
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        any(ml.link_analysis(., mode="aggressive").redirect_history,
            any(flatten(values(.query_params_decoded)),
                strings.icontains(.,
                                  'onerror="window.location=decodeURIComponent(atob('
                )
            )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.