High Severity

VIP impersonation: VIP name within a delimited subject with fake previous threads

Labels

BEC/Fraud

Impersonation: VIP

Description

Detects inbound messages where a known VIP's display name appears in the subject line surrounded by quotation marks or forward-slash delimiters (e.g., /Name/, Name (in quotes), -//Name), and where prior thread history confirms the VIP either authored a previous message or is being actively impersonated by a mismatched sender. Observed lures include fabricated invoices, leadership recognition offers, and forwarded billing threads referencing real executives by name and company. The pattern spans multiple sender domains and spoofed invoice references, all anchored to VIP identity signals extracted from thread context.

References

No references.

Sublime Security

Created Jul 8th, 2026 • Last updated Jul 8th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
and strings.icontains(strings.replace_confusables(subject.base),
                      '"',
                      '/-/',
                      '-//',
                      '-/',
                      '-#'
)
and any(body.previous_threads,
        any($org_vips,
            (
              strings.icontains(strings.replace_confusables(subject.base),
                                strings.concat('"', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat(.display_name, '"')
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('/-/', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-//', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-/', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-#', .display_name)
              )
            )
            and (
              strings.icontains(..sender.display_name, .display_name)
              or (
                .email != "" and strings.icontains(..sender.email.email, .email)
              )
              or (
                strings.icontains(sender.display_name, .display_name)
                and sender.email.email != .email
              )
            )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Request to View Invoice",
          "Payment Information"
        )
        and .confidence != "low"
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.