Detection Method: Content analysis

Content analysis looks at the language and structure of a message to identify signs of phishing, social engineering, and other malicious intent. Instead of scanning for keywords, this method uses natural language understanding (NLU) to detect meaning, intent, and tone across the message.
Content analysis helps detect:
  • BEC attempts with urgent messages from executive impersonators
  • Credential phishing disguised as login or document notifications
  • Callback scams posing as account renewals or fake support
  • Extortion threats or blackmail messages
  • Financial or personal data requests in suspicious contexts
  • Fake job offers targeting employees
  • Invoice fraud, payroll fraud, and more
For example, a phishing email may impersonate a CFO asking for a wire transfer. Content analysis can flag the urgent tone, financial context, and impersonation attempt.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (7):
Credential Phishing
Callback Phishing
Spam
Malware/Ransomware
BEC/Fraud
Reconnaissance
Extortion
Tactics & Techniques (23):
Impersonation: Brand
Social engineering
Spoofing
PDF
Evasion
HTML smuggling
Lookalike domain
Free file host
Impersonation: VIP
ICS Phishing
Open redirect
Free subdomain host
Free email provider
Out of band pivot
Encryption
Impersonation: Employee
QR code
Image as content
Exploit
Scripting
Macros
LNK
Service abuse
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Partiful
3h ago
Oct 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
URL analysis
Brand impersonation: QuickBooks
3h ago
Oct 26th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Link: Romance/Sexual Language With Suspicious Link
4h ago
Oct 26th, 2026
Sublime Security
Spam
Social engineering
Content analysis
Header analysis
URL analysis
Whois
Brand impersonation: Federal court system
4h ago
Oct 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Spoofing
Natural Language Understanding
Content analysis
Header analysis
Sender analysis
Attachment: PDF with a suspicious string and single URL
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
Credential phishing: Financial lure via ActiveCampaign infrastructure
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Attachment: EML file with HTML attachment (unsolicited)
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
HTML smuggling
Content analysis
File analysis
Header analysis
HTML analysis
Sender analysis
Brand impersonation: Dropbox
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
File analysis
Header analysis
Sender analysis
Brand impersonation: Google Workspace alert notification
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Lookalike domain
Header analysis
Content analysis
Sender analysis
URL analysis
Link: Zoho form link from unsolicited sender
4d ago
Oct 23rd, 2026
Sublime Security
Callback Phishing
Free file host
Content analysis
URL analysis
Sender analysis
Service abuse: Power BI shared document lure
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Social engineering
Free file host
URL analysis
Content analysis
Service abuse: Microsoft messaging with Cloudflare Turnstile-gated link
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
URL analysis
Content analysis
Sender analysis
Link: Google Cloud Storage /index and /unsub link pair
4d ago
Oct 23rd, 2026
Sublime Security
Spam
Free file host
Social engineering
URL analysis
Content analysis
BEC/Fraud: Fake investment outreach from suspicious TLD
5d ago
Oct 22nd, 2026
Sublime Security
BEC/Fraud
Social engineering
Header analysis
Sender analysis
Content analysis
Natural Language Understanding
Spam: Large financial amount mention from newly registered sender domain
5d ago
Oct 22nd, 2026
Sublime Security
BEC/Fraud
Spam
Social engineering
Content analysis
Sender analysis
Whois
Link: Large guest list with suspicious link
5d ago
Oct 22nd, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
URL analysis
VIP impersonation: Invoice fraud with mobile device sign-off
5d ago
Oct 22nd, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Sender analysis
Credential phishing: Suspicious e-sign agreement document notification
5d ago
Oct 22nd, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Sender analysis
Prompt injection: Hidden instructions to an AI in body HTML
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Evasion
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
Sender analysis
Prompt injection: Instructions to an AI in a calendar invite
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Evasion
Social engineering
Content analysis
File analysis
Natural Language Understanding
Sender analysis
Page 1 of 25