Medium Severity

Service abuse: Postman reply-to mismatch with credential theft intent

Labels

Credential Phishing
Social engineering
Out of band pivot
Sender analysis
Header analysis
Natural Language Understanding

Description

Detects inbound messages sent from Postman.io where the reply-to address belongs to a different domain than the sender, combined with high or medium confidence credential theft intent detected in the message body. This technique leverages a legitimate service to deliver messages while redirecting replies to an attacker-controlled address.

References

No references.

Sublime Security
Created Jul 29th, 2026 • Last updated Jul 29th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and sender.email.domain.root_domain == "postman.io"
and any(headers.reply_to,
        .email.domain.root_domain != sender.email.domain.root_domain
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started