Medium Severity

Link: Fake forwarded message with suspicious URL in plain text

Labels

Credential Phishing

BEC/Fraud

Description

Detects inbound plain text messages (no HTML body) with no prior thread history that contain a URL and are structured as a forwarded message. The rule checks for a 'Begin forwarded message' preamble, either standalone or followed by a From field matching the sender's display name, suggesting the message may be disguising its origin or delivering malicious links via forwarded message formatting.

References

No references.

Sublime Security

Created Jul 20th, 2026 • Last updated Jul 20th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and body.html.raw is null
and length(body.previous_threads) == 0
and regex.contains(body.current_thread.text, 'https?://')
and (
  regex.imatch(body.current_thread.preamble, 'begin forwarded message:\s*')
  or (
    regex.imatch(body.current_thread.preamble,
                 'begin forwarded message:\s*from:\s*[^<@\n]+\s*'
    )
    and strings.icontains(body.current_thread.preamble, sender.display_name)
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.