Medium Severity
Link: Figma Design Deck With Credential Phishing Language
Description
A single link to a Figma design deck that contains credential theft language. The message comes from either a new sender, one with previously detected malicious activity, or a known sender who has not been in contact for over 30 days and has no history of benign messages.
References
No references.
Sublime Security
Created May 7th, 2025 • Last updated May 7th, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
// only one link to Figma
and length(distinct(filter(body.links,
.href_url.domain.root_domain in ("figma.com")
and strings.istarts_with(.href_url.path, "/deck")
),
.href_url.url
)
) == 1
and any(filter(body.links,
.href_url.domain.root_domain in ("figma.com")
and strings.istarts_with(.href_url.path, "/deck")
),
any(ml.nlu_classifier(beta.ocr(ml.link_analysis(.).screenshot).text).intents,
.name == "cred_theft" and .confidence in ("medium", "high")
)
)
and (
(
profile.by_sender().prevalence in ("new", "outlier")
and not profile.by_sender().solicited
)
or profile.by_sender().any_messages_malicious_or_spam
or profile.by_sender().days_since.last_contact > 30
)
and not profile.by_sender().any_messages_benign
Playground
Test against your own EMLs or sample data.