Detection Method: Content analysis

Content analysis looks at the language and structure of a message to identify signs of phishing, social engineering, and other malicious intent. Instead of scanning for keywords, this method uses natural language understanding (NLU) to detect meaning, intent, and tone across the message.
Content analysis helps detect:
  • BEC attempts with urgent messages from executive impersonators
  • Credential phishing disguised as login or document notifications
  • Callback scams posing as account renewals or fake support
  • Extortion threats or blackmail messages
  • Financial or personal data requests in suspicious contexts
  • Fake job offers targeting employees
  • Invoice fraud, payroll fraud, and more
For example, a phishing email may impersonate a CFO asking for a wire transfer. Content analysis can flag the urgent tone, financial context, and impersonation attempt.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (8):
Credential Phishing
BEC/Fraud
Malware/Ransomware
Callback Phishing
Spam
ICS Phishing
Extortion
Reconnaissance
Tactics & Techniques (26):
Impersonation: Brand
Social engineering
Free file host
PDF
Evasion
Free subdomain host
QR code
Lookalike domain
Impersonation: VIP
Encryption
Spoofing
Impersonation: Employee
Free email provider
Out of band pivot
Image as content
LNK
HTML smuggling
Open redirect
ICS Phishing
Scripting
Exploit
Service abuse
Macros
Credential Phishing
OneNote
HTML injection
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Punchbowl
14h ago
Jul 15th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Sender analysis
Link: Free file host link with 'Important Viewing Note' lure
19h ago
Jul 15th, 2026
Sublime Security
Credential Phishing
Free file host
Social engineering
Impersonation: Brand
Content analysis
URL analysis
Threat intelligence
Brand impersonation: Internal Revenue Service
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
Attachment: PDF with suspicious document view lure
2d ago
Jul 14th, 2026
Sublime Security
Malware/Ransomware
PDF
Social engineering
Content analysis
File analysis
YARA
Business Email Compromise (BEC) with request for mobile number
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Credential phishing: Generic document share with unicode and proceedural greeting template
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Evasion
Content analysis
Natural Language Understanding
Link: Fraudulent state business filing notice
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Social engineering
Impersonation: Brand
Content analysis
Natural Language Understanding
URL analysis
Service abuse: Microsoft Forms Pro with suspicious links or QR codes
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
QR code
Social engineering
Impersonation: Brand
URL analysis
QR code analysis
Sender analysis
Whois
Content analysis
Brand impersonation: Government / Tax Authority document lure
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Free subdomain host
Social engineering
Lookalike domain
Sender analysis
URL analysis
Natural Language Understanding
Content analysis
Threat intelligence
Service abuse: Notion free-tier account impersonating VIP
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
Impersonation: VIP
Social engineering
Sender analysis
Header analysis
URL analysis
Content analysis
VIP impersonation: VIP payment redirect handoff via fake threads
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
VIP impersonation: Payment handoff with VIP display name authored fake threads
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
Attachment: Encrypted PDF with credential theft language in EML
3d ago
Jul 13th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
VIP impersonation: Fake thread with VIPs missing email metadata
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Spoofing
Natural Language Understanding
Header analysis
Content analysis
Sender analysis
Link: Generic financial document with proceedural timeline template
6d ago
Jul 10th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Evasion
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
Impersonation: Employee name in subject with suspicious sender
6d ago
Jul 10th, 2026
Sublime Security
BEC/Fraud
Impersonation: Employee
Impersonation: VIP
Free email provider
Social engineering
Spoofing
Sender analysis
Content analysis
Brand impersonation: AARP
7d ago
Jul 9th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
Brand impersonation: OpenAI with payment issues
7d ago
Jul 9th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
Credential phishing: Blue button styled link with file-sharing template artifacts
8d ago
Jul 8th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
URL analysis
Reconnaissance: Fake real estate inquiry with empty body
8d ago
Jul 8th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Sender analysis
Page 1 of 25