Detection Method: Natural Language Understanding

Natural Language Understanding (NLU) uses machine learning algorithms to analyze and interpret message content, helping systems detect subtle signs of malicious intent. Instead of just matching keywords, NLU looks at the context, tone, urgency, and intent behind the message.
NLU can help you detect:
  • Urgent language commonly used in BEC attacks impersonating executives or departments
  • Credential theft attempts disguised as legitimate service notifications
  • Extortion or blackmail tactics used in intimidation campaigns
  • Financial terms typically found in payment fraud or invoice scams
  • Deceptive job offers designed to steal sensitive information
For example, NLU can identify when an email uses urgent language ("immediate attention required") combined with financial requests ("wire transfer") and impersonation, which are common tactics in BEC attacks.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
BEC/Fraud
Credential Phishing
Callback Phishing
Spam
Malware/Ransomware
Extortion
Tactics & Techniques (21):
Social engineering
Spoofing
Evasion
Impersonation: Employee
Impersonation: Brand
Free file host
Free subdomain host
Image as content
Out of band pivot
PDF
Open redirect
Free email provider
ICS Phishing
Impersonation: VIP
Scripting
Encryption
QR code
Lookalike domain
Macros
HTML smuggling
IPFS
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
BEC/Fraud: Fake investment outreach from suspicious TLD
39m ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Social engineering
Header analysis
Sender analysis
Content analysis
Natural Language Understanding
Fake voicemail notification (untrusted sender)
1h ago
Oct 6th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Spoofing: Hidden Outlook headers in self-addressed forwards
4h ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spoofing
Evasion
Impersonation: Employee
Social engineering
Header analysis
HTML analysis
XML analysis
Sender analysis
Natural Language Understanding
Service abuse: Google callback scam
4h ago
Oct 6th, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Spoofing
Social engineering
Natural Language Understanding
Sender analysis
Service Abuse: American Express callback scam
5h ago
Oct 6th, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Content analysis
Sender analysis
Attachment: Excel file with hyperlinks to suspicious domains
6h ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Free file host
Free subdomain host
Social engineering
Natural Language Understanding
Content analysis
Exif analysis
File analysis
URL analysis
Link: Possible Intuit link abuse
1d ago
Oct 5th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
URL analysis
Natural Language Understanding
Content analysis
Header analysis
Attachment: Fake email body embedded in inline image
1d ago
Oct 5th, 2026
Sublime Security
Credential Phishing
Image as content
Social engineering
Evasion
Optical Character Recognition
Natural Language Understanding
HTML analysis
Header analysis
Sender analysis
Credential phishing: Generic document sharing
2d ago
Oct 4th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Social engineering
Evasion
Impersonation: Employee
Content analysis
Natural Language Understanding
URL analysis
Sender analysis
Service abuse: Microsoft Power Apps callback scam
4d ago
Oct 2nd, 2026
Sublime Security
Callback Phishing
Impersonation: Brand
Out of band pivot
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Google Authenticator
4d ago
Oct 2nd, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Impersonation: Brand
Spoofing
Natural Language Understanding
Header analysis
Sender analysis
Business Email Compromise: Request for mobile number via reply thread hijacking
4d ago
Oct 2nd, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Attachment: Fictitious invoice using LinkedIn's address
5d ago
Oct 1st, 2026
Sublime Security
BEC/Fraud
PDF
Social engineering
File analysis
Optical Character Recognition
Natural Language Understanding
Content analysis
Exif analysis
Evasion: Credential phishing with newly registered domain redirecting to Wikipedia
5d ago
Oct 1st, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Natural Language Understanding
URL analysis
Whois
Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link
5d ago
Oct 1st, 2026
Sublime Security
Credential Phishing
PDF
Open redirect
Social engineering
Exif analysis
Optical Character Recognition
Natural Language Understanding
URL analysis
File analysis
Credential phishing: Email delivery failure impersonation
5d ago
Oct 1st, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Credential phishing: Engaging language and other indicators (untrusted sender)
5d ago
Oct 1st, 2026
Sublime Security
Credential Phishing
Free email provider
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Service abuse: Apple callback scam
7d ago
Sep 29th, 2026
Sublime Security
Callback Phishing
Social engineering
Out of band pivot
Sender analysis
Header analysis
Natural Language Understanding
Credential phishing language and suspicious indicators (unknown sender)
7d ago
Sep 29th, 2026
Sublime Security
Credential Phishing
Free email provider
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender
7d ago
Sep 29th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Page 1 of 15