Sublime Security

Sublime Core Feed
File analysis
Learn More
Login to Sublime
Attack Types
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Reconnaissance
Spam
Tactics and Techniques
Encryption
Evasion
Exploit
Free email provider
Free file host
Free subdomain host
HTML smuggling
ICS Phishing
Image as content
Impersonation: Brand
Impersonation: Employee
Impersonation: VIP
IPFS
ISO
LNK
Lookalike domain
Macros
OneNote
Open redirect
Out of band pivot
PDF
Punycode
QR code
Scripting
Social engineering
Spoofing
Detection Methods
Archive analysis
Content analysis
Computer Vision
Exif analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Macro analysis
Natural Language Understanding
Optical Character Recognition
OLE analysis
PDF analysis
QR code analysis
Sender analysis
Threat intelligence
URL analysis
URL screenshot
Whois
XML analysis
YARA
Detection Method: File analysis
File analysis breaks down and inspects file contents, formats, and embedded elements to uncover hidden threats. This method goes beyond basic file attributes, deeply examining the inner structure of files to find potentially malicious content that looks legitimate on the surface.
File analysis helps detect:
Malicious macros in Office documents (Word, Excel, PowerPoint)
Obfuscated scripts hidden in PDFs or other document types
Executable code disguised in non-executable files
Hidden text content using encoding or steganography
Suspicious metadata or file properties suggesting tampering
Blog Posts
Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Abusing Discord to deliver Agent Tesla malware · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction · Blog · Sublime Security
Attack Types (7):
ICS Phishing
Credential Phishing
Malware/Ransomware
Spam
BEC/Fraud
Callback Phishing
Extortion
Tactics & Techniques (25):
Social engineering
Impersonation: Brand
Spoofing
Open redirect
Evasion
Free file host
Image as content
PDF
Free subdomain host
Lookalike domain
ICS Phishing
Out of band pivot
HTML smuggling
Encryption
Free email provider
Macros
Exploit
QR code
Scripting
Impersonation: VIP
LNK
OneNote
Impersonation: Employee
IPFS
ISO
Rule Name & Severity
Last Updated
Types, Tactics & Capabilities
Attachment: ICS invite meeting lure
1h ago
Aug 27th, 2026
Sublime Security
ICS Phishing
Credential Phishing
Social engineering
Impersonation: Brand
Spoofing
Open redirect
Content analysis
URL analysis
Header analysis
Sender analysis
File analysis
ICS Phishing
Credential Phishing
Social engineering
Impersonation: Brand
Spoofing
Open redirect
Content analysis
URL analysis
Header analysis
Sender analysis
File analysis
Link: Microsoft protected message with suspicious recipient patterns
2h ago
Aug 27th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
File analysis
Header analysis
Sender analysis
URL analysis
Credential Phishing
Evasion
Social engineering
Content analysis
File analysis
Header analysis
Sender analysis
URL analysis
Brand impersonation: Microsoft with low reputation links
4h ago
Aug 27th, 2026
Sublime Security
Credential Phishing
Free file host
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
Credential Phishing
Free file host
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
Attachment: PDF Grant Payment lure with embedded link
21h ago
Aug 26th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
File analysis
URL analysis
Content analysis
Credential Phishing
PDF
Social engineering
File analysis
URL analysis
Content analysis
Attachment: Risk assessment PDF with inline image
2d ago
Aug 25th, 2026
Sublime Security
Malware/Ransomware
Spam
Image as content
PDF
Social engineering
File analysis
HTML analysis
Header analysis
Sender analysis
Malware/Ransomware
Spam
Image as content
PDF
Social engineering
File analysis
HTML analysis
Header analysis
Sender analysis
Attachment: Invoice and W-9 PDFs with suspicious creators
2d ago
Aug 25th, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
BEC/Fraud
PDF
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
Exif analysis
Content analysis
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
2d ago
Aug 25th, 2026
Sublime Security
BEC/Fraud
ICS Phishing
Social engineering
Free file host
Free subdomain host
Lookalike domain
File analysis
Content analysis
URL analysis
Whois
BEC/Fraud
ICS Phishing
Social engineering
Free file host
Free subdomain host
Lookalike domain
File analysis
Content analysis
URL analysis
Whois
Attachment: PDF proposal with credential theft indicators
3d ago
Aug 24th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Credential Phishing
PDF
Social engineering
Evasion
File analysis
Natural Language Understanding
Optical Character Recognition
URL analysis
Attachment: ZIP containing Office binary with embedded DLL
3d ago
Aug 24th, 2026
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
File analysis
YARA
Malware/Ransomware
Evasion
Archive analysis
File analysis
YARA
Attachment: PDF with suspicious HeadlessChrome metadata
3d ago
Aug 24th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
PDF
File analysis
Exif analysis
Credential Phishing
Malware/Ransomware
Evasion
PDF
File analysis
Exif analysis
Attachment: ICS calendar invite with financial lure and suspicious link
5d ago
Aug 22nd, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Social engineering
Evasion
File analysis
Content analysis
URL analysis
Whois
Header analysis
Credential Phishing
BEC/Fraud
Social engineering
Evasion
File analysis
Content analysis
URL analysis
Whois
Header analysis
Attachment: Image-only docx/pptx callback phishing
6d ago
Aug 21st, 2026
Sublime Security
Callback Phishing
Image as content
Impersonation: Brand
Social engineering
File analysis
Optical Character Recognition
Content analysis
Callback Phishing
Image as content
Impersonation: Brand
Social engineering
File analysis
Optical Character Recognition
Content analysis
Attachment: QuickBooks PDF lure
7d ago
Aug 20th, 2026
Sublime Security
BEC/Fraud
Malware/Ransomware
PDF
Impersonation: Brand
Social engineering
YARA
File analysis
BEC/Fraud
Malware/Ransomware
PDF
Impersonation: Brand
Social engineering
YARA
File analysis
Attachment: PDF with embedded box-lure and javascript
8d ago
Aug 19th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
Social engineering
Evasion
File analysis
YARA
Credential Phishing
Malware/Ransomware
PDF
Social engineering
Evasion
File analysis
YARA
Attachment: PDF templated investment lure
8d ago
Aug 19th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
PDF
Social engineering
YARA
File analysis
Malware/Ransomware
Credential Phishing
PDF
Social engineering
YARA
File analysis
Attachment: PDF with a suspicious string and single URL
8d ago
Aug 19th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
Attachment: PDF with suspicious link and action-oriented language
9d ago
Aug 18th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
File analysis
URL analysis
Content analysis
URL screenshot
Credential Phishing
PDF
Social engineering
Evasion
File analysis
URL analysis
Content analysis
URL screenshot
Brand impersonation: Sharepoint
9d ago
Aug 18th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Natural Language Understanding
Sender analysis
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Natural Language Understanding
Sender analysis
Attachment: RTF with link to free-hosted Cloudflare Pages
14d ago
Aug 13th, 2026
Sublime Security
Credential Phishing
Free subdomain host
File analysis
URL analysis
HTML analysis
Sender analysis
Credential Phishing
Free subdomain host
File analysis
URL analysis
HTML analysis
Sender analysis
Attachment: PDF with base64 JavaScript and eval functions
16d ago
Aug 11th, 2026
Sublime Security
Malware/Ransomware
Evasion
PDF
File analysis
Javascript analysis
YARA
Malware/Ransomware
Evasion
PDF
File analysis
Javascript analysis
YARA
Page 1 of 16

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Attachment: ICS invite meeting lure	1h ago Aug 27th, 2026	Sublime Security	ICS Phishing Credential Phishing Social engineering Impersonation: Brand Spoofing Open redirect Content analysis URL analysis Header analysis Sender analysis File analysis
Link: Microsoft protected message with suspicious recipient patterns	2h ago Aug 27th, 2026	Sublime Security	Credential Phishing Evasion Social engineering Content analysis File analysis Header analysis Sender analysis URL analysis
Brand impersonation: Microsoft with low reputation links	4h ago Aug 27th, 2026	Sublime Security	Credential Phishing Free file host Image as content Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Header analysis Natural Language Understanding Optical Character Recognition Sender analysis URL analysis
Attachment: PDF Grant Payment lure with embedded link	21h ago Aug 26th, 2026	Sublime Security	Credential Phishing PDF Social engineering File analysis URL analysis Content analysis
Attachment: Risk assessment PDF with inline image	2d ago Aug 25th, 2026	Sublime Security	Malware/Ransomware Spam Image as content PDF Social engineering File analysis HTML analysis Header analysis Sender analysis
Attachment: Invoice and W-9 PDFs with suspicious creators	2d ago Aug 25th, 2026	Sublime Security	BEC/Fraud PDF Social engineering Impersonation: Brand File analysis Optical Character Recognition Exif analysis Content analysis
Attachment: ICS calendar invite with bid/RFP lure and suspicious link	2d ago Aug 25th, 2026	Sublime Security	BEC/Fraud ICS Phishing Social engineering Free file host Free subdomain host Lookalike domain File analysis Content analysis URL analysis Whois
Attachment: PDF proposal with credential theft indicators	3d ago Aug 24th, 2026	Sublime Security	Credential Phishing PDF Social engineering Evasion File analysis Natural Language Understanding Optical Character Recognition URL analysis
Attachment: ZIP containing Office binary with embedded DLL	3d ago Aug 24th, 2026	Sublime Security	Malware/Ransomware Evasion Archive analysis File analysis YARA
Attachment: PDF with suspicious HeadlessChrome metadata	3d ago Aug 24th, 2026	Sublime Security	Credential Phishing Malware/Ransomware Evasion PDF File analysis Exif analysis
Attachment: ICS calendar invite with financial lure and suspicious link	5d ago Aug 22nd, 2026	Sublime Security	Credential Phishing BEC/Fraud Social engineering Evasion File analysis Content analysis URL analysis Whois Header analysis
Attachment: Image-only docx/pptx callback phishing	6d ago Aug 21st, 2026	Sublime Security	Callback Phishing Image as content Impersonation: Brand Social engineering File analysis Optical Character Recognition Content analysis
Attachment: QuickBooks PDF lure	7d ago Aug 20th, 2026	Sublime Security	BEC/Fraud Malware/Ransomware PDF Impersonation: Brand Social engineering YARA File analysis
Attachment: PDF with embedded box-lure and javascript	8d ago Aug 19th, 2026	Sublime Security	Credential Phishing Malware/Ransomware PDF Social engineering Evasion File analysis YARA
Attachment: PDF templated investment lure	8d ago Aug 19th, 2026	Sublime Security	Malware/Ransomware Credential Phishing PDF Social engineering YARA File analysis
Attachment: PDF with a suspicious string and single URL	8d ago Aug 19th, 2026	Sublime Security	Credential Phishing PDF Social engineering Evasion Content analysis File analysis URL analysis Exif analysis
Attachment: PDF with suspicious link and action-oriented language	9d ago Aug 18th, 2026	Sublime Security	Credential Phishing PDF Social engineering Evasion File analysis URL analysis Content analysis URL screenshot
Brand impersonation: Sharepoint	9d ago Aug 18th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Social engineering Computer Vision Content analysis File analysis Natural Language Understanding Sender analysis
Attachment: RTF with link to free-hosted Cloudflare Pages	14d ago Aug 13th, 2026	Sublime Security	Credential Phishing Free subdomain host File analysis URL analysis HTML analysis Sender analysis
Attachment: PDF with base64 JavaScript and eval functions	16d ago Aug 11th, 2026	Sublime Security	Malware/Ransomware Evasion PDF File analysis Javascript analysis YARA