• Sublime Core Feed
Medium Severity

Xero Infrastructure Abuse

Labels

Credential Phishing
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
URL analysis

Description

Identifies messages that resemble credential theft, originating from Xero. Xero infrastrcture abuse has been observed recently to send phishing attacks.

References

No references.

Sublime Security
Created May 9th, 2025 • Last updated May 23rd, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and sender.email.email == "messaging-service@post.xero.com"
and 
// there are external links (not org or xero domains)
length(filter(body.links,
              .href_url.domain.domain not in $org_domains
              and .href_url.domain.root_domain not in ("xero.com", )
       )
) > 0
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  // subject match when cred_theft doesn't match
  // high confidence observed subject intros in the format of "Urgent Thing: ..."
  or regex.icontains(subject.subject,
                     '^(?:(?:Final|Last)?\s*Warning|(?:Final|Last|Legal|Critical|Content Violation)?\s*(?:Alert|Noti(?:ce|fication))|Appeal Required|Time.Sensitive|Critical.Alert|Important|Copyright Issue)\s*:\s*'
  )
  or any(ml.logo_detect(beta.message_screenshot()).brands,
         .name in ("Facebook", "Meta", "Instagram")
         and .confidence in ("medium", "high")
  )
  // any of the links are for newly registered domains
  or any(filter(body.links,
                .href_url.domain.domain not in $org_domains
                and .href_url.domain.root_domain not in ("xero.com")
         ),
         network.whois(.href_url.domain).days_old < 30
  )
  or (
    any(beta.ml_topic(body.current_thread.text).topics,
        .name == "Professional and Career Development" and .confidence != "low"
    )
  )
)
and (
  ( // sender domain matches no body domains
    length(body.links) > 0
    and all(body.links,
            .href_url.domain.root_domain not in ("xero.com", )
            or .href_url.domain.root_domain is null
    )
  )
  // link contains email address
  or any(recipients.to,
         .email.domain.valid
         and any(body.links,
                 strings.icontains(.href_url.url, ..email.email)
                 or any(beta.scan_base64(.href_url.url,
                                         format="url",
                                         ignore_padding=true
                        ),
                        strings.icontains(., ...email.email)
                 )
                 or any(beta.scan_base64(.href_url.fragment,
                                         ignore_padding=true
                        ),
                        strings.icontains(., ...email.email)
                 )
                 // cloudflare turnstile or phishing warning page
                 or strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.display_text,
                                      "cloudflare"
                 )
         )
  )
  or regex.icontains(subject.subject,
                     "termination.*notice",
                     "38417",
                     ":completed",
                     "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                     "[il][il][il]egai[ -]",
                     "[li][li][li]ega[li] attempt",
                     "[ng]-?[io]n .*block",
                     "[ng]-?[io]n .*cancel",
                     "[ng]-?[io]n .*deactiv",
                     "[ng]-?[io]n .*disabl",
                     "action.*required",
                     "abandon.*package",
                     "about.your.account",
                     "acc(ou)?n?t (is )?on ho[li]d",
                     "acc(ou)?n?t.*terminat",
                     "acc(oun)?t.*[il1]{2}mitation",
                     "access.*limitation",
                     "account (will be )?block",
                     "account.*de-?activat",
                     "account.*locked",
                     "account.*restrict",
                     "account.*re-verification",
                     "account.*security",
                     "account.*suspension",
                     "account.has.been",
                     "account.has.expired",
                     "account.will.be.blocked",
                     "account v[il]o[li]at",
                     "activity.*acc(oun)?t",
                     "almost.full",
                     "app[li]e.[il]d",
                     "appeal required",
                     "authenticate.*account",
                     "been.*suspend",
                     "clos.*of.*account.*processed",
                     "confirm.your.account",
                     "copyright (?:restriction|infringment)",
                     "courier.*able",
                     "crediential.*notif",
                     "Critical Alert",
                     "deactivation.*in.*progress",
                     "delivery.*attempt.*failed",
                     "document.received",
                     "documented.*shared.*with.*you",
                     "dropbox.*document",
                     "e-?ma[il1]+ .{010}suspen",
                     "e-?ma[il1]{1} user",
                     "e-?ma[il1]{2} acc",
                     "e-?ma[il1]{2}.*up.?grade",
                     "e.?ma[il1]{2}.*server",
                     "e.?ma[il1]{2}.*suspend",
                     "email.update",
                     "faxed you",
                     "final notice",
                     "fraud(ulent)?.*charge",
                     "from.helpdesk",
                     "fu[il1]{2}.*ma[il1]+[ -]?box",
                     "has.been.*suspended",
                     "has.been.limited",
                     "have.locked",
                     "he[li]p ?desk upgrade",
                     "heipdesk",
                     "i[il]iega[il]",
                     "ii[il]ega[il]",
                     "immediate action",
                     "incoming e?mail",
                     "incoming.*fax",
                     "lock.*security",
                     "ma[il1]{1}[ -]?box.*quo",
                     "ma[il1]{2}[ -]?box.*fu[il1]",
                     "ma[il1]{2}box.*[il1]{2}mit",
                     "ma[il1]{2}box stor",
                     "mail on.?hold",
                     "mail.*box.*migration",
                     "mail.*de-?activat",
                     "mail.update.required",
                     "mails.*pending",
                     "messages.*pending",
                     "missed.*shipping.*notification",
                     "missed.shipment.notification",
                     "must.update.your.account",
                     "new [sl][io]g?[nig][ -]?in from",
                     "new voice ?-?mail",
                     "notifications.*pending",
                     "office.*3.*6.*5.*suspend",
                     "office365",
                     "on google docs with you",
                     "online doc",
                     "password.*compromised",
                     "periodic maintenance",
                     "potential(ly)? unauthorized",
                     "refund not approved",
                     "restrictions applied",
                     "report",
                     "revised.*policy",
                     "scam",
                     "scanned.?invoice",
                     "secured?.update",
                     "security breach",
                     "securlty",
                     "signed.*delivery",
                     "social media",
                     "status of your .{314}? ?delivery",
                     "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                     "suspicious.*sign.*[io]n",
                     "suspicious.activit",
                     "temporar(il)?y deactivate",
                     "temporar[il1]{2}y disab[li]ed",
                     "temporarily.*lock",
                     "time.sensitive",
                     "un-?usua[li].activity",
                     "unable.*deliver",
                     "unauthorized.*activit",
                     "unauthorized.device",
                     "unauthorized.use",
                     "undelivered message",
                     "unread.*doc",
                     "unusual.activity",
                     "upgrade.*account",
                     "upgrade.notice",
                     "urgent message",
                     "urgent.verification",
                     "v[il1]o[li1]at[il1]on security",
                     "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                     "verification ?-?require",
                     "verification( )?-?need",
                     "verify.your?.account",
                     "web ?-?ma[il1]{2}",
                     "web[ -]?ma[il1]{2}",
                     "will.be.suspended",
                     "your (customer )?account .as",
                     "your.office.365",
                     "your.online.access",
                     "Critical.Notice",
                     "Restore.Access",
                     // https://github.com/sublime-security/static-files/blob/master/suspicious_subjects.txt
                     "account has been limited",
                     "action required",
                     "almost full",
                     "apd notifi cation",
                     "are you at your desk",
                     "are you available",
                     "attached file to docusign",
                     "banking is temporarily unavailable",
                     "bankofamerica",
                     "closing statement invoice",
                     "completed: docusign",
                     "de-activation of",
                     "delivery attempt",
                     "delivery stopped for shipment",
                     "detected suspicious",
                     "detected suspicious actvity",
                     "docu sign",
                     "document for you",
                     "document has been sent to you via docusign",
                     "document is ready for signature",
                     "docusign",
                     "encrypted message",
                     "failed delivery",
                     "fedex tracking",
                     "file was shared",
                     "freefax",
                     "fwd: due invoice paid",
                     "has shared",
                     "inbox is full",
                     "invitation to comment",
                     "invitation to edit",
                     "invoice due",
                     "left you a message",
                     "message from",
                     "new message",
                     "new voicemail",
                     "on desk",
                     "out of space",
                     "password reset",
                     "payment status",
                     "quick reply",
                     "re: w-2",
                     "required",
                     "required: completed docusign",
                     "remittance",
                     "ringcentral",
                     "scanned image",
                     "secured files",
                     "secured pdf",
                     "security alert",
                     "new sign-in",
                     "new sign in",
                     "sign-in attempt",
                     "sign in attempt",
                     "staff review",
                     "suspicious activity",
                     "unrecognized login attempt",
                     "upgrade immediately",
                     "urgent",
                     "wants to share",
                     "w2",
                     "you have notifications pending",
                     "your account",
                     'your (?:\w+\s+){0,1}\s*account',
                     "your amazon order",
                     "your document settlement",
                     "your order with amazon",
                     "your password has been compromised",
  )
  or any($suspicious_subjects, strings.icontains(subject.subject, .))
  or any(ml.nlu_classifier(body.current_thread.text).entities,
       .name == "sender" and strings.icontains(.text, 'Recruitment')
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started