Detection Method: Threat intelligence

Threat intelligence uses data feeds and insights about known and emerging phishing threats to give you proactive protection against attackers. This method taps into massive databases of indicators of compromise (IoCs), helping your security systems recognize patterns, techniques, and infrastructure that have been seen in past attacks.
Threat intelligence can help you identify:
  • Domains and URLs linked to previous phishing campaigns
  • File hashes associated with known malware samples
  • IP addresses connected to command and control servers
  • Email patterns that match identified threat actors
  • Emerging threats based on recently observed attack tactics
For example, when a new phishing campaign targeting a specific industry is discovered, threat intelligence feeds can share the indicators of that campaign, so you can block similar attempts before they even reach your users.
Blog Post
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
Gotta Catch 'Em All: Detecting PikaBot Delivery Techniques · Blog · Sublime Security
A brief background of PikaBot with a focus on recently observed attack techniques and email detection methods.
Attack Types (2):
Credential Phishing
Malware/Ransomware
Tactics & Techniques (9):
Evasion
Social engineering
Spoofing
Free file host
Free subdomain host
Open redirect
Scripting
PDF
Impersonation: Brand
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Body: Fake secure email portal with HTML obfuscation
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Service abuse: Google OAuth with suspicious redirect destination
26d ago
May 27th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Free subdomain host
Open redirect
Social engineering
URL analysis
Threat intelligence
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)
1mo ago
Apr 29th, 2026
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
File analysis
Sender analysis
Threat intelligence
Link: Landing page with search-ms protocol redirect
2mo ago
Apr 7th, 2026
Sublime Security
Malware/Ransomware
Evasion
Scripting
URL analysis
Threat intelligence
MalwareBazaar: Malicious attachment hash (trusted reporters)
2mo ago
Mar 26th, 2026
Sublime Security
Malware/Ransomware
File analysis
Sender analysis
Threat intelligence
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
3mo ago
Mar 2nd, 2026
Sublime Security
Malware/Ransomware
PDF
Evasion
File analysis
Threat intelligence
Link: URL redirecting to blob URL
3mo ago
Feb 24th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
Free file host
Open redirect
Sender analysis
URL analysis
Threat intelligence
Link: 9WOLF phishkit initial landing URI
4mo ago
Jan 30th, 2026
Sublime Security
Malware/Ransomware
Evasion
URL analysis
Threat intelligence
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters)
5mo ago
Jan 12th, 2026
Sublime Security
Credential Phishing
Malware/Ransomware
PDF
File analysis
Threat intelligence
URL analysis
Malware: Pikabot delivery via URL auto-download
2y ago
Apr 25th, 2024
Sublime Security
Malware/Ransomware
Evasion
Archive analysis
File analysis
Threat intelligence
URL analysis
Brand impersonation: ukr[.]net
3y ago
Aug 21st, 2023
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Sender analysis
Threat intelligence