Detection Method: Natural Language Understanding

Natural Language Understanding (NLU) uses machine learning algorithms to analyze and interpret message content, helping systems detect subtle signs of malicious intent. Instead of just matching keywords, NLU looks at the context, tone, urgency, and intent behind the message.
NLU can help you detect:
  • Urgent language commonly used in BEC attacks impersonating executives or departments
  • Credential theft attempts disguised as legitimate service notifications
  • Extortion or blackmail tactics used in intimidation campaigns
  • Financial terms typically found in payment fraud or invoice scams
  • Deceptive job offers designed to steal sensitive information
For example, NLU can identify when an email uses urgent language ("immediate attention required") combined with financial requests ("wire transfer") and impersonation, which are common tactics in BEC attacks.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Credential Phishing
BEC/Fraud
Callback Phishing
Spam
Malware/Ransomware
Extortion
Tactics & Techniques (21):
Impersonation: Brand
Social engineering
Spoofing
Out of band pivot
Evasion
Impersonation: VIP
Open redirect
PDF
Encryption
Impersonation: Employee
Free file host
Free subdomain host
Image as content
Free email provider
ICS Phishing
Scripting
QR code
Lookalike domain
Macros
HTML smuggling
IPFS
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Federal court system
4h ago
Oct 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Spoofing
Natural Language Understanding
Content analysis
Header analysis
Sender analysis
Credential phishing: Financial lure via ActiveCampaign infrastructure
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Bluehost
4d ago
Oct 23rd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Header analysis
Sender analysis
BEC/Fraud: Fake investment outreach from suspicious TLD
5d ago
Oct 22nd, 2026
Sublime Security
BEC/Fraud
Social engineering
Header analysis
Sender analysis
Content analysis
Natural Language Understanding
Service abuse: Upwork callback scam
5d ago
Oct 22nd, 2026
Sublime Security
Callback Phishing
Social engineering
Out of band pivot
Natural Language Understanding
Sender analysis
Service abuse: Freshbooks callback scam
6d ago
Oct 21st, 2026
Sublime Security
Callback Phishing
Social engineering
Natural Language Understanding
Sender analysis
Prompt injection: Body instructions addressed to an AI
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Evasion
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Prompt injection: Hidden instructions to an AI in body HTML
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Evasion
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
Sender analysis
Prompt injection: Instructions to an AI in a calendar invite
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Evasion
Social engineering
Content analysis
File analysis
Natural Language Understanding
Sender analysis
VIP impersonation: Payment handoff with VIP display name authored fake threads
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
VIP impersonation: VIP payment redirect handoff via fake threads
6d ago
Oct 21st, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Header analysis
Job scam with specific salary pattern
12d ago
Oct 15th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
Open Redirect: Google domain with /url path and suspicious indicators
13d ago
Oct 14th, 2026
Sublime Security
Credential Phishing
Evasion
Open redirect
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
Business Email Compromise: Request for mobile number via reply thread hijacking
13d ago
Oct 14th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: MyChart
13d ago
Oct 14th, 2026
Sublime Security
Credential Phishing
Spam
Impersonation: Brand
Social engineering
Spoofing
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
Link: Credential theft via newly registered suspicious domain in query parameter
18d ago
Oct 9th, 2026
Sublime Security
Credential Phishing
Social engineering
Open redirect
Natural Language Understanding
URL analysis
Whois
Sender analysis
Attachment: Fictitious invoice using LinkedIn's address
18d ago
Oct 9th, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
File analysis
Optical Character Recognition
Natural Language Understanding
Content analysis
Exif analysis
Brand impersonation: MetaMask
18d ago
Oct 9th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Natural Language Understanding
Sender analysis
Header analysis
Attachment: Encrypted PDF with credential theft body
19d ago
Oct 8th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
Link: Credential phishing with cloaked content
19d ago
Oct 8th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
URL analysis
HTML analysis
Natural Language Understanding
Content analysis
Page 1 of 16