Enterprise anti-phishing software built for modern email attacks

QR code phishing

Hides a malicious link inside a QR code, often in an image or PDF attachment, to route around filters built to scan visible text and links. QR codes also move the attack off a monitored device, since a person usually scans with a personal phone, outside any corporate security stack, which is part of why this technique has grown so fast. Sublime decodes embedded QR codes during analysis and evaluates the resulting destination with the same scrutiny applied to a direct link.

ICS phishing

Delivers a malicious calendar invite instead of an email, exploiting the fact that many tools don't inspect ICS attachments closely and that invites carry an implicit trust an ordinary email doesn't. A convincing invite can auto-populate a victim's calendar before anyone has scrutinized it the way they would a suspicious message. Sublime applies the same scrutiny to invite metadata, sender legitimacy, and embedded links that it applies to email body content, closing a gap many tools leave open.

Callback phishing

Uses an email with no malicious link, just a phone number and a plausible pretext like an invoice, a subscription renewal, or a fraud alert, to move the attack to a live phone call where a person is socially engineered in real time. Because the email itself carries no payload, link and attachment scanning has nothing to flag. Sublime's language models read the urgency and pretext patterns that typically precede a callback, correlated against sender history, to catch what link-only scanning would miss.

Business email compromise

Impersonates an executive, vendor, or partner to redirect a payment, change banking details, or extract sensitive data, often with no attachment or link at all, just a convincingly worded request. BEC and fraud account for nearly one in three confirmed email threats, per Sublime's Email Threat Research Report, and thread hijacking, quietly inserting a fraudulent reply into an existing conversation, is the leading technique behind it. Sublime's relationship and behavior analysis flags spoofed domains, unusual payment requests, and hijacked threads that a generic rule set would read as ordinary correspondence.