Tactic or Technique: Social engineering

Social engineering targets people instead of systems. Attackers use persuasion, pressure, or emotional cues to get you to act quickly and bypass security tools without realizing it.
Messages often create urgency, mimic authority figures, or feel familiar enough to lower your guard. An attacker might pose as your manager asking for a quick favor, reference a recent company event, or claim your account is about to be locked. These tricks are designed to feel legitimate and get you to respond without verifying the request.
Common approaches include pretexting, where attackers invent a believable scenario; baiting, where they offer something enticing; or quid pro quo, where they offer help in exchange for access. Even a single successful interaction can lead to broader compromise, including data theft, ransomware, or a full network breach.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Fake invoice used to conduct $16,800 BEC attempt · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Attack Types (6):
Credential Phishing
BEC/Fraud
Spam
Malware/Ransomware
Callback Phishing
Extortion
Detection Methods (20):
Natural Language Understanding
Computer Vision
Optical Character Recognition
URL analysis
URL screenshot
Sender analysis
Content analysis
Header analysis
File analysis
QR code analysis
Exif analysis
HTML analysis
Whois
Archive analysis
YARA
Macro analysis
Javascript analysis
OLE analysis
XML analysis
Threat intelligence
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Link: Figma design deck with credential theft language
13h ago
Mar 4th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Social engineering
Natural Language Understanding
Computer Vision
Optical Character Recognition
URL analysis
URL screenshot
Sender analysis
/feeds/core/detection-rules/link-figma-design-deck-with-credential-theft-language-87601924
Brand Impersonation: Disney
17h ago
Mar 4th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Natural Language Understanding
Content analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-disney-bf90b8fb
Service abuse: DocSend share from an unsolicited reply-to address
18h ago
Mar 4th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Social engineering
Content analysis
Header analysis
Sender analysis
/feeds/core/detection-rules/service-abuse-docsend-share-from-an-unsolicited-reply-to-address-b377e64c
Attachment: PDF with recipient email in link
2d ago
Mar 3rd, 2026
Sublime Security
Credential Phishing
PDF
QR code
Encryption
Social engineering
File analysis
QR code analysis
URL analysis
/feeds/core/detection-rules/attachment-pdf-with-recipient-email-in-link-0399d08f
BEC with unusual reply-to or return-path mismatch
2d ago
Mar 3rd, 2026
Sublime Security
BEC/Fraud
Evasion
Free email provider
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/bec-with-unusual-reply-to-or-return-path-mismatch-83e5e2df
Link: Google Forms link with credential theft language
3d ago
Mar 2nd, 2026
Sublime Security
Credential Phishing
Social engineering
Natural Language Understanding
Sender analysis
URL analysis
/feeds/core/detection-rules/link-google-forms-link-with-credential-theft-language-0cad40e2
Fake warning banner using confusable characters
3d ago
Mar 2nd, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Evasion
Social engineering
Content analysis
/feeds/core/detection-rules/fake-warning-banner-using-confusable-characters-179ee1ff
Attachment: PDF with a suspicious string and single URL
3d ago
Mar 2nd, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
URL analysis
Exif analysis
/feeds/core/detection-rules/attachment-pdf-with-a-suspicious-string-and-single-url-3bdbb7ad
Brand impersonation: Chase Bank
3d ago
Mar 2nd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-chase-bank-c680f1e7
Attachment: PDF with suspicious link and action-oriented language
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
PDF
Social engineering
Evasion
File analysis
URL analysis
Content analysis
URL screenshot
/feeds/core/detection-rules/attachment-pdf-with-suspicious-link-and-action-oriented-language-816d33a0
Brand impersonation: Zoom via HTML styling
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
/feeds/core/detection-rules/brand-impersonation-zoom-via-html-styling-b717920d
Attachment: PDF with multistage landing - ClickUp abuse
6d ago
Feb 27th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
PDF
Social engineering
File analysis
URL analysis
Whois
/feeds/core/detection-rules/attachment-pdf-with-multistage-landing-clickup-abuse-0dc40316
Attachment: Encrypted PDF with credential theft body
7d ago
Feb 26th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/attachment-encrypted-pdf-with-credential-theft-body-c9596c9a
Reconnaissance: Empty message from uncommon sender
8d ago
Feb 25th, 2026
Sublime Security
Spam
Evasion
Social engineering
Content analysis
Header analysis
/feeds/core/detection-rules/reconnaissance-empty-message-from-uncommon-sender-b347cdbc
Credential theft with 'safe content' deception and social engineering topics
8d ago
Feb 25th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
Content analysis
Natural Language Understanding
/feeds/core/detection-rules/credential-theft-with-safe-content-deception-and-social-engineering-topics-22ceee0d
Brand impersonation: DocuSign
9d ago
Feb 24th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Spoofing
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-docusign-4d29235c
Spam: Sendersrv.com with financial communications and unsubscribe language
9d ago
Feb 24th, 2026
Sublime Security
Spam
Evasion
Social engineering
Header analysis
Content analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/spam-sendersrvcom-with-financial-communications-and-unsubscribe-language-69570820
Brand impersonation: Meta and subsidiaries
10d ago
Feb 23rd, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-meta-and-subsidiaries-e38f1e3b
Tax Form: W-8BEN solicitation
10d ago
Feb 23rd, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Content analysis
Header analysis
URL analysis
/feeds/core/detection-rules/tax-form-w-8ben-solicitation-a64edb69
Reconnaissance: Email address harvesting attempt
10d ago
Feb 23rd, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Free email provider
Social engineering
Content analysis
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/reconnaissance-email-address-harvesting-attempt-bb31efbc
Page 1 of 25