Detection Method: Computer Vision

Computer Vision uses image recognition to analyze visual elements in messages, attachments, and web content to detect threats or impersonation attempts. It examines logos, screenshots, and HTML to find signs of phishing or fraud.
Computer Vision can detect:
  • Brand impersonation with fake logos (e.g., Microsoft, PayPal)
  • Visual elements of phishing pages, like login forms
  • CAPTCHAs used to bypass security systems
  • Malicious content disguised as legitimate visuals
For example, attackers often create fake login pages mimicking trusted brands, and Computer Vision can detect these attempts by recognizing misused logos with high confidence.
Blog Posts
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Credential Phishing
Callback Phishing
Malware/Ransomware
Spam
BEC/Fraud
Extortion
Tactics & Techniques (18):
Impersonation: Brand
Social engineering
Evasion
QR code
Image as content
Free file host
Free subdomain host
Exploit
Out of band pivot
Lookalike domain
Free email provider
PDF
Macros
Open redirect
Impersonation: Employee
Spoofing
Scripting
HTML smuggling
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: File sharing notification with template artifacts
16m ago
Jan 23rd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Evasion
HTML analysis
Computer Vision
Content analysis
Header analysis
/feeds/core/detection-rules/brand-impersonation-file-sharing-notification-with-template-artifacts-37d89611
Attachment: QR code with recipient targeting and special characters
2d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
QR code
Social engineering
Evasion
File analysis
QR code analysis
URL analysis
Computer Vision
/feeds/core/detection-rules/attachment-qr-code-with-recipient-targeting-and-special-characters-fc9e1c09
Brand impersonation: Fake Fax
2d ago
Jan 21st, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Image as content
Free file host
Free subdomain host
Social engineering
Computer Vision
Content analysis
Optical Character Recognition
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-fake-fax-2a96b90a
Brand impersonation: USPS
3d ago
Jan 20th, 2026
Sublime Security
Credential Phishing
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/brand-impersonation-usps-28b9130a
Brand impersonation: Quickbooks
8d ago
Jan 15th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-quickbooks-4fd791d1
Callback phishing via Xodo Sign comment
11d ago
Jan 12th, 2026
Sublime Security
Callback Phishing
Exploit
Impersonation: Brand
Out of band pivot
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/callback-phishing-via-xodo-sign-comment-6f722c5d
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
/feeds/core/detection-rules/credential-phishing-docusign-embedded-image-lure-with-no-docusign-domains-in-links-dfe8715e
Suspicious invoice reference with missing or image-only attachments
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Computer Vision
File analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/suspicious-invoice-reference-with-missing-or-image-only-attachments-466c1680
Brand Impersonation: PayPal
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-paypal-a6b2ceee
Free subdomain link with login or captcha (untrusted sender)
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Social engineering
Computer Vision
File analysis
Sender analysis
URL screenshot
/feeds/core/detection-rules/free-subdomain-link-with-login-or-captcha-untrusted-sender-93288f82
Brand impersonation: Microsoft with low reputation links
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Free file host
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-microsoft-with-low-reputation-links-b59201b6
Link: Multistage landing - Abused Adobe Acrobat hosted PDF
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Optical Character Recognition
URL analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/link-multistage-landing-abused-adobe-acrobat-hosted-pdf-609081ef
Link: Multistage landing - Scribd document
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Impersonation: Brand
Free file host
URL analysis
HTML analysis
Natural Language Understanding
Computer Vision
Optical Character Recognition
URL screenshot
/feeds/core/detection-rules/link-multistage-landing-scribd-document-afa9807d
Suspicious recipients pattern with no Compauth pass and suspicious content
11d ago
Jan 12th, 2026
Sublime Security
Content analysis
Computer Vision
Header analysis
Natural Language Understanding
URL analysis
URL screenshot
/feeds/core/detection-rules/suspicious-recipients-pattern-with-no-compauth-pass-and-suspicious-content-34fb65f6
Suspicious recipient pattern and language with low reputation link to login
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Social engineering
Computer Vision
Content analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
URL screenshot
/feeds/core/detection-rules/suspicious-recipient-pattern-and-language-with-low-reputation-link-to-login-a8ea0402
Callback phishing via Adobe Sign comment
11d ago
Jan 12th, 2026
Sublime Security
Callback Phishing
Evasion
Impersonation: Brand
Out of band pivot
Social engineering
Content analysis
Computer Vision
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/callback-phishing-via-adobe-sign-comment-7eb4516d
Brand Impersonation: Disney
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Natural Language Understanding
Content analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-disney-bf90b8fb
Brand impersonation: Sharepoint fake file share
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Impersonation: Brand
Social engineering
Content analysis
Header analysis
URL analysis
Computer Vision
/feeds/core/detection-rules/brand-impersonation-sharepoint-fake-file-share-ff8b296b
Attachment: HTML smuggling - QR Code with suspicious links
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
QR code
Computer Vision
Header analysis
Natural Language Understanding
QR code analysis
Sender analysis
URL analysis
URL screenshot
/feeds/core/detection-rules/attachment-html-smuggling-qr-code-with-suspicious-links-010e757d
Credential phishing: Image as content, short or no body contents
11d ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Evasion
Image as content
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
/feeds/core/detection-rules/credential-phishing-image-as-content-short-or-no-body-contents-01313f38
Page 1 of 5