Detection Method: Natural Language Understanding

Natural Language Understanding (NLU) uses machine learning algorithms to analyze and interpret message content, helping systems detect subtle signs of malicious intent. Instead of just matching keywords, NLU looks at the context, tone, urgency, and intent behind the message.
NLU can help you detect:
  • Urgent language commonly used in BEC attacks impersonating executives or departments
  • Credential theft attempts disguised as legitimate service notifications
  • Extortion or blackmail tactics used in intimidation campaigns
  • Financial terms typically found in payment fraud or invoice scams
  • Deceptive job offers designed to steal sensitive information
For example, NLU can identify when an email uses urgent language ("immediate attention required") combined with financial requests ("wire transfer") and impersonation, which are common tactics in BEC attacks.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Credential Phishing
BEC/Fraud
Callback Phishing
Spam
Extortion
Malware/Ransomware
Tactics & Techniques (21):
Social engineering
Open redirect
PDF
Impersonation: Brand
Encryption
Evasion
Spoofing
Impersonation: Employee
Free file host
Free subdomain host
Image as content
Out of band pivot
Free email provider
ICS Phishing
Impersonation: VIP
Scripting
QR code
Lookalike domain
Macros
HTML smuggling
IPFS
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Link: Credential theft via newly registered suspicious domain in query parameter
4d ago
Oct 9th, 2026
Sublime Security
Credential Phishing
Social engineering
Open redirect
Natural Language Understanding
URL analysis
Whois
Sender analysis
Attachment: Fictitious invoice using LinkedIn's address
4d ago
Oct 9th, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
File analysis
Optical Character Recognition
Natural Language Understanding
Content analysis
Exif analysis
Brand impersonation: MetaMask
4d ago
Oct 9th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Natural Language Understanding
Sender analysis
Header analysis
Attachment: Encrypted PDF with credential theft body
5d ago
Oct 8th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
Link: Credential phishing with cloaked content
5d ago
Oct 8th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
URL analysis
HTML analysis
Natural Language Understanding
Content analysis
Attachment: Encrypted PDF with credential phishing link
5d ago
Oct 8th, 2026
Sublime Security
Credential Phishing
PDF
Encryption
Evasion
Social engineering
File analysis
Content analysis
Whois
URL analysis
Natural Language Understanding
Brand impersonation: Aconex
6d ago
Oct 7th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Spoofing
Natural Language Understanding
Content analysis
Header analysis
Sender analysis
Link: Gmail confidential mode message with job scam subject
6d ago
Oct 7th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Evasion
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Link: Monday hosted link with suspicious content
6d ago
Oct 7th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Social engineering
Natural Language Understanding
URL analysis
Header analysis
BEC/Fraud: Fake investment outreach from suspicious TLD
7d ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Social engineering
Header analysis
Sender analysis
Content analysis
Natural Language Understanding
Fake voicemail notification (untrusted sender)
7d ago
Oct 6th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Spoofing: Hidden Outlook headers in self-addressed forwards
7d ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spoofing
Evasion
Impersonation: Employee
Social engineering
Header analysis
HTML analysis
XML analysis
Sender analysis
Natural Language Understanding
Service abuse: Google callback scam
7d ago
Oct 6th, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Spoofing
Social engineering
Natural Language Understanding
Sender analysis
Service Abuse: American Express callback scam
7d ago
Oct 6th, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Content analysis
Sender analysis
Attachment: Excel file with hyperlinks to suspicious domains
7d ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Free file host
Free subdomain host
Social engineering
Natural Language Understanding
Content analysis
Exif analysis
File analysis
URL analysis
Attachment: Fake email body embedded in inline image
8d ago
Oct 5th, 2026
Sublime Security
Credential Phishing
Image as content
Social engineering
Evasion
Optical Character Recognition
Natural Language Understanding
HTML analysis
Header analysis
Sender analysis
Link: Possible Intuit link abuse
8d ago
Oct 5th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
URL analysis
Natural Language Understanding
Content analysis
Header analysis
Credential phishing: Generic document sharing
9d ago
Oct 4th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Social engineering
Evasion
Impersonation: Employee
Content analysis
Natural Language Understanding
URL analysis
Sender analysis
Service abuse: Microsoft Power Apps callback scam
11d ago
Oct 2nd, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Out of band pivot
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Google Authenticator
11d ago
Oct 2nd, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Impersonation: Brand
Spoofing
Natural Language Understanding
Header analysis
Sender analysis
Page 1 of 16