Detection Method: Natural Language Understanding

Natural Language Understanding (NLU) uses machine learning algorithms to analyze and interpret message content, helping systems detect subtle signs of malicious intent. Instead of just matching keywords, NLU looks at the context, tone, urgency, and intent behind the message.
NLU can help you detect:
  • Urgent language commonly used in BEC attacks impersonating executives or departments
  • Credential theft attempts disguised as legitimate service notifications
  • Extortion or blackmail tactics used in intimidation campaigns
  • Financial terms typically found in payment fraud or invoice scams
  • Deceptive job offers designed to steal sensitive information
For example, NLU can identify when an email uses urgent language ("immediate attention required") combined with financial requests ("wire transfer") and impersonation, which are common tactics in BEC attacks.
Blog Posts
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Combating GenAI Email Attacks with BERT LLM · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Payroll Fraud via LLM-Generated Emails · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Credential Phishing
BEC/Fraud
Callback Phishing
Spam
Extortion
Malware/Ransomware
Tactics & Techniques (21):
Image as content
Impersonation: Brand
Social engineering
Free email provider
QR code
Evasion
Free subdomain host
Impersonation: Employee
Spoofing
PDF
Scripting
Free file host
ICS Phishing
Out of band pivot
Lookalike domain
Macros
Encryption
Open redirect
Impersonation: VIP
IPFS
HTML smuggling
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: USPS
14h ago
Jun 1st, 2026
Sublime Security
Credential Phishing
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Sharepoint
14h ago
Jun 1st, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Natural Language Understanding
Sender analysis
Reconnaissance: Short generic greeting message
4d ago
May 29th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Social engineering
Free email provider
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Spam: Website errors solicitation
4d ago
May 29th, 2026
Sublime Security
Spam
Content analysis
Sender analysis
Natural Language Understanding
Credential phishing: Engaging language and other indicators (untrusted sender)
4d ago
May 29th, 2026
Sublime Security
Credential Phishing
Free email provider
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Impersonation Link: Cloud branding service with credential theft language
4d ago
May 29th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Attachment: Compensation-themed DOCX with QR code credential theft
4d ago
May 29th, 2026
Sublime Security
Credential Phishing
QR code
Social engineering
Impersonation: Brand
File analysis
Optical Character Recognition
QR code analysis
Natural Language Understanding
Exif analysis
Content analysis
Business Email Compromise: Request for mobile number via reply thread hijacking
5d ago
May 28th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Link: Self-sender credential theft with configuration placeholder
6d ago
May 27th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
Natural Language Understanding
Content analysis
URL analysis
Header analysis
Business Email Compromise (BEC) with request for mobile number
7d ago
May 26th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Credential phishing: Onedrive impersonation
7d ago
May 26th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Natural Language Understanding
URL analysis
Credential phishing: Generic document sharing
11d ago
May 22nd, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Social engineering
Evasion
Impersonation: Employee
Content analysis
Natural Language Understanding
URL analysis
Sender analysis
Service abuse: Elastic alerts extortion
12d ago
May 21st, 2026
Sublime Security
Extortion
Impersonation: Brand
Social engineering
Natural Language Understanding
Sender analysis
Headers: X-Source-Auth mismatch with mismatched reply-to domain
12d ago
May 21st, 2026
Sublime Security
BEC/Fraud
Social engineering
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Service abuse: Calendly callback scam detection
12d ago
May 21st, 2026
Sublime Security
Callback Phishing
Social engineering
Impersonation: Brand
Natural Language Understanding
Sender analysis
Extortion / sextortion (untrusted sender)
13d ago
May 20th, 2026
Sublime Security
Extortion
Social engineering
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Fake thread with suspicious indicators
14d ago
May 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
15d ago
May 18th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
X (Twitter) impersonation with credential phishing motives
18d ago
May 15th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
File analysis
Header analysis
Optical Character Recognition
Natural Language Understanding
Sender analysis
Attachment: Microsoft impersonation via PDF with link and suspicious language
19d ago
May 14th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Image as content
Impersonation: Brand
PDF
Scripting
Social engineering
Computer Vision
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Page 1 of 12