Medium Severity

Service abuse: Apple callback scam

Labels

Callback Phishing
Social engineering
Out of band pivot
Sender analysis
Header analysis
Natural Language Understanding

Description

Detects inbound messages spoofing Apple's automated notification address where the reply-to domain diverges from apple.com, combined with a natural language understanding classifier identifying callback scam intent in the message body with medium or high confidence.

References

No references.

Sublime Security
Created Sep 29th, 2026 • Last updated Sep 29th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and sender.email.email == "noreply@email.apple.com"
and any(headers.reply_to, .email.domain.root_domain != "apple.com")
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started