Medium Severity

Service abuse: FileMail callback scam

Labels

Callback Phishing
Social engineering
Free file host
Out of band pivot
Natural Language Understanding
Sender analysis
Content analysis

Description

Detects inbound messages from FileMail's no-reply address where the first line of the email body is classified with high confidence as a callback scam using natural language understanding. Attackers leverage legitimate file sharing services to deliver fraudulent messages that instruct recipients to call a phone number, often impersonating tech support or financial institutions.

References

No references.

Sublime Security
Created Jul 24th, 2026 • Last updated Jul 24th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and sender.email.email == "no-reply@filemail.com"
and any(ml.nlu_classifier(regex.extract(body.current_thread.text,
                                        '^(?P<first_line>[^\n]+)\n'
                          )[0].named_groups["first_line"]
        ).intents,
        .name == "callback_scam" and .confidence == "high"
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started