Service abuse: Payoneer callback scam

calendar Sep 28, 2026  ยท
Share on: linkedin copy

A fraudulent invoice/receipt found in the body of the message sent by leveraging Payoneer's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Sublime rule (View on GitHub)

  1name: "Service abuse: Payoneer callback scam"
  2description: "A fraudulent invoice/receipt found in the body of the message sent by leveraging Payoneer's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and length(attachments) == 0
  8  and sender.email.domain.root_domain in ("payoneer.com")
  9  and (
 10    (
 11      // icontains a phone number
 12      (
 13        regex.icontains(strings.replace_confusables(body.current_thread.text),
 14                        '.*\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\n'
 15        )
 16        or regex.icontains(strings.replace_confusables(body.current_thread.text),
 17                           '.*\+[ilo0-9]{1,3}[ilo0-9]{10}.*\n'
 18        )
 19        // +12028001238
 20        or regex.icontains(strings.replace_confusables(body.current_thread.text),
 21                           '.*[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.*\n'
 22        )
 23        // 202-800-1238
 24        or regex.icontains(strings.replace_confusables(body.current_thread.text),
 25                           '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
 26        )
 27        // (202) 800-1238
 28        or regex.icontains(strings.replace_confusables(body.current_thread.text),
 29                           '.*\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.*\n'
 30        )
 31        // (202)-800-1238
 32        or regex.icontains(strings.replace_confusables(body.current_thread.text),
 33                           '.*\([ilo0-9]{3}\)-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
 34        )
 35        or ( // 8123456789
 36          regex.icontains(strings.replace_confusables(body.current_thread.text),
 37                          '.*8[ilo0-9]{9}.*\n'
 38          )
 39          and regex.icontains(strings.replace_confusables(body.current_thread.text
 40                              ),
 41                              '\+[1l]'
 42          )
 43        )
 44      )
 45      and (
 46        (
 47          // list of keywords synced with other rules, see related_detections
 48          4 of (
 49            strings.ilike(body.html.inner_text, '*you did not*'),
 50            strings.ilike(body.html.inner_text, '*is not for*'),
 51            strings.ilike(body.html.inner_text, '*done by you*'),
 52            regex.icontains(body.html.inner_text, "didn\'t ma[kd]e this"),
 53            strings.ilike(body.html.inner_text, "*Fruad Alert*"),
 54            strings.ilike(body.html.inner_text, "*Fraud Alert*"),
 55            strings.ilike(body.html.inner_text, '*using your PayPal*'),
 56            strings.ilike(body.html.inner_text, '*subscription*'),
 57            strings.ilike(body.html.inner_text, '*antivirus*'),
 58            strings.ilike(body.html.inner_text, '*order*'),
 59            strings.ilike(body.html.inner_text, '*support*'),
 60            strings.ilike(body.html.inner_text, '*receipt*'),
 61            strings.ilike(body.html.inner_text, '*invoice*'),
 62            strings.ilike(body.html.inner_text, '*Purchase*'),
 63            strings.ilike(body.html.inner_text, '*transaction*'),
 64            strings.ilike(body.html.inner_text, '*Market*Value*'),
 65            strings.ilike(body.html.inner_text, '*BTC*'),
 66            strings.ilike(body.html.inner_text, '*call*'),
 67            strings.ilike(body.html.inner_text, '*get in touch with our*'),
 68            strings.ilike(body.html.inner_text, '*quickly inform*'),
 69            strings.ilike(body.html.inner_text, '*quickly reach *'),
 70            strings.ilike(body.html.inner_text, '*detected unusual transactions*'),
 71            strings.ilike(body.html.inner_text, '*cancel*'),
 72            strings.ilike(body.html.inner_text, '*renew*'),
 73            strings.ilike(body.html.inner_text, '*refund*'),
 74            strings.ilike(body.html.inner_text, '*+1*'),
 75            regex.icontains(body.html.inner_text, 'help.{0,3}desk'),
 76          )
 77        )
 78      )
 79    )
 80    or (
 81      // Unicode confusables words obfuscated in note
 82      regex.icontains(body.html.inner_text,
 83                      '\+๐Ÿญ|๐—ฝ๐—ฎ๐˜†๐—บ๐—ฒ๐—ป๐˜|๐—›๐—ฒ๐—น๐—ฝ ๐——๐—ฒ๐˜€๐—ธ|๐—ฟ๐—ฒ๐—ณ๐˜‚๐—ป๐—ฑ|๐—ฎ๐—ป๐˜๐—ถ๐˜ƒ๐—ถ๐—ฟ๐˜‚๐˜€|๐—ฐ๐—ฎ๐—น๐—น|๐—ฐ๐—ฎ๐—ป๐—ฐ๐—ฒ๐—น'
 84      )
 85    )
 86    or strings.ilike(body.html.inner_text, '*kindly*')
 87  )  
 88attack_types:
 89  - "Callback Phishing"
 90  - "BEC/Fraud"
 91tactics_and_techniques:
 92  - "Evasion"
 93  - "Social engineering"
 94detection_methods:
 95  - "Sender analysis"
 96  - "Header analysis"
 97  - "Content analysis"
 98related_detections:
 99  - "paypal_invoice_abuse.yml"
100  - "callback_phishing_sumup.yml"
101id: "b7fb174c-c5a0-567a-8090-6ca142d94562"
to-top