High Severity

Service abuse: Adobe share containing newly observed email address domain

Labels

Credential Phishing

BEC/Fraud

Description

Detects legitimate Adobe notification emails that contain a genuine Adobe-hosted document link alongside a mailto link with an external email address that is not the recipient, not part of the organization's domains, not associated with Adobe, and has never been observed in prior inbound or outbound mail. This pattern indicates abuse of Adobe's trusted email infrastructure to redirect victims into contacting an attacker-controlled address outside the normal mail flow.

References

No references.

Sublime Security

Created Jul 31st, 2026 • Last updated Jul 31st, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// from Adobe
and sender.email.email == 'message@adobe.com'
// the email address in the body
and any(filter(body.links,
               .href_url.scheme == 'mailto'
               // is not the recipient
               and .href_url.url !~ recipients.to[0].email.email
               // not in org domains
               and .href_url.domain.domain not in $org_domains
               // and not adobe
               and .href_url.domain.root_domain != "adobe.com"
        ),
        // and has not been observed inbound/outbound in the environment
        .href_url.domain.domain not in $sender_domains
        and .href_url.domain.domain not in $recipient_domains
)
// there is a single link to an adobe hosted content
and length(distinct(filter(body.links,
                           .href_url.domain.root_domain == "adobe.com"
                           and strings.istarts_with(.href_url.path, '/id/urn:')
                    ),
                    .href_url.url
           )
) == 1

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.