Detection Method: Natural Language Understanding

Natural Language Understanding (NLU) uses machine learning algorithms to analyze and interpret message content, helping systems detect subtle signs of malicious intent. Instead of just matching keywords, NLU looks at the context, tone, urgency, and intent behind the message.
NLU can help you detect:
  • Urgent language commonly used in BEC attacks impersonating executives or departments
  • Credential theft attempts disguised as legitimate service notifications
  • Extortion or blackmail tactics used in intimidation campaigns
  • Financial terms typically found in payment fraud or invoice scams
  • Deceptive job offers designed to steal sensitive information
For example, NLU can identify when an email uses urgent language ("immediate attention required") combined with financial requests ("wire transfer") and impersonation, which are common tactics in BEC attacks.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
BEC/Fraud
Credential Phishing
Callback Phishing
Spam
Malware/Ransomware
Extortion
Tactics & Techniques (21):
Impersonation: Brand
Social engineering
Evasion
Free subdomain host
Lookalike domain
Impersonation: VIP
Encryption
PDF
Spoofing
Free file host
Image as content
Free email provider
Out of band pivot
Scripting
HTML smuggling
Impersonation: Employee
QR code
Open redirect
ICS Phishing
Macros
IPFS
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Internal Revenue Service
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
Service abuse: Calendly callback scam detection
2d ago
Jul 14th, 2026
Sublime Security
Callback Phishing
Social engineering
Impersonation: Brand
Natural Language Understanding
Sender analysis
Credential phishing: Generic document share with unicode and proceedural greeting template
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Evasion
Content analysis
Natural Language Understanding
Link: Fraudulent state business filing notice
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Social engineering
Impersonation: Brand
Content analysis
Natural Language Understanding
URL analysis
Business Email Compromise (BEC) with request for mobile number
2d ago
Jul 14th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Government / Tax Authority document lure
2d ago
Jul 14th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Free subdomain host
Social engineering
Lookalike domain
Sender analysis
URL analysis
Natural Language Understanding
Content analysis
Threat intelligence
VIP impersonation: VIP payment redirect handoff via fake threads
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
VIP impersonation: Payment handoff with VIP display name authored fake threads
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
Attachment: Encrypted PDF with credential theft language in EML
3d ago
Jul 13th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
VIP impersonation: Fake thread with VIPs missing email metadata
3d ago
Jul 13th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Spoofing
Natural Language Understanding
Header analysis
Content analysis
Sender analysis
Link: Generic financial document with proceedural timeline template
6d ago
Jul 10th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Evasion
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
Service abuse: Oracle Cloud Workflow callback scam
6d ago
Jul 10th, 2026
Sublime Security
Callback Phishing
Social engineering
Impersonation: Brand
Sender analysis
HTML analysis
Natural Language Understanding
Service abuse: Facebook mail notification callback scam
7d ago
Jul 9th, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Social engineering
Spoofing
Sender analysis
Natural Language Understanding
Zoom Events newsletter abuse
8d ago
Jul 8th, 2026
Sublime Security
Credential Phishing
Free file host
Free subdomain host
Social engineering
Impersonation: Brand
Header analysis
HTML analysis
Natural Language Understanding
URL analysis
Brand impersonation: Amazon Web Services (AWS)
10d ago
Jul 6th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Optical Character Recognition
Sender analysis
Natural Language Understanding
Spam: Website errors solicitation
10d ago
Jul 6th, 2026
Sublime Security
Spam
Content analysis
Sender analysis
Natural Language Understanding
Business Email Compromise: Request for mobile number via reply thread hijacking
10d ago
Jul 6th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
BEC: Executive coaching vendor impersonation
15d ago
Jul 1st, 2026
Sublime Security
BEC/Fraud
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators
15d ago
Jul 1st, 2026
Sublime Security
BEC/Fraud
Spam
Social engineering
Image as content
Free email provider
Free file host
Out of band pivot
Natural Language Understanding
Header analysis
Sender analysis
Content analysis
URL analysis
File analysis
Credential phishing: Onedrive impersonation
16d ago
Jun 30th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Natural Language Understanding
URL analysis
Page 1 of 13