Attachment: Image-only docx/pptx callback phishing

calendar Aug 21, 2026  ·
Share on: linkedin copy

Detects inbound emails with docx or pptx attachments that contain no text but exactly one embedded image, a common tactic to evade text-based scanning by presenting content as a picture. The rule then inspects any extracted text from the image for a combination of callback phishing lures—such as references to subscriptions, invoices, refunds, or antivirus renewals alongside phone numbers or dollar amounts—paired with impersonation of well-known brands like PayPal, McAfee, Norton, or Best Buy, indicating a fraudulent phone-based scam attempt.

Sublime rule (View on GitHub)

 1name: "Attachment: Image-only docx/pptx callback phishing"
 2description: "Detects inbound emails with docx or pptx attachments that contain no text but exactly one embedded image, a common tactic to evade text-based scanning by presenting content as a picture. The rule then inspects any extracted text from the image for a combination of callback phishing lures—such as references to subscriptions, invoices, refunds, or antivirus renewals alongside phone numbers or dollar amounts—paired with impersonation of well-known brands like PayPal, McAfee, Norton, or Best Buy, indicating a fraudulent phone-based scam attempt."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain in $free_email_providers
 8  and any(attachments,
 9          .file_type in ("docx", "pptx")
10          and any(file.explode(.),
11                  (.scan.docx.word_count == 0 and .scan.docx.image_count == 1)
12                  or (.scan.pptx.word_count == 0 and .scan.pptx.image_count == 1)
13          )
14          and any(file.explode(.),
15                  (.depth == 0 or .flavors.mime == "text/plain")
16                  // 4 of the following strings are found
17                  and 4 of (
18                    // this section is synced with attachment_callback_phish_with_pdf.yml and body_callback_phishing_no_attachment.yml
19                    strings.icontains(.scan.strings.raw, "purchase"),
20                    strings.icontains(.scan.strings.raw, "payment"),
21                    strings.icontains(.scan.strings.raw, "transaction"),
22                    strings.icontains(.scan.strings.raw, "subscription"),
23                    strings.icontains(.scan.strings.raw, "antivirus"),
24                    strings.icontains(.scan.strings.raw, "order"),
25                    strings.icontains(.scan.strings.raw, "support"),
26                    strings.icontains(.scan.strings.raw, "help line"),
27                    strings.icontains(.scan.strings.raw, "receipt"),
28                    strings.icontains(.scan.strings.raw, "invoice"),
29                    strings.icontains(.scan.strings.raw, "call"),
30                    strings.icontains(.scan.strings.raw, "helpdesk"),
31                    strings.icontains(.scan.strings.raw, "cancel"),
32                    strings.icontains(.scan.strings.raw, "renew"),
33                    strings.icontains(.scan.strings.raw, "refund"),
34                    regex.icontains(.scan.strings.raw, "(?:reach|contact) us at"),
35                    strings.icontains(.scan.strings.raw, "+1"),
36                    strings.icontains(.scan.strings.raw, "amount"),
37                    strings.icontains(.scan.strings.raw, "charged"),
38                    strings.icontains(.scan.strings.raw, "crypto"),
39                    strings.icontains(.scan.strings.raw, "wallet address"),
40                    regex.icontains(.scan.strings.raw, '\$\d{3}\.\d{2}\b'),
41                    regex.icontains(.scan.strings.raw,
42                                    '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
43                                    '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
44                    ),
45                  )
46                  and regex.icontains(.scan.strings.raw,
47                                      '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t|quickbooks|amazon)'
48                  )
49          )
50  )  
51attack_types:
52  - "Callback Phishing"
53tactics_and_techniques:
54  - "Image as content"
55  - "Impersonation: Brand"
56  - "Social engineering"
57detection_methods:
58  - "File analysis"
59  - "Optical Character Recognition"
60  - "Content analysis"
61id: "7d6bf731-af14-5ce6-9e0d-a792cbde6fa8"
to-top