Attachment: Fake email body embedded in inline image

calendar Sep 25, 2026  ·
Share on: linkedin copy

Catches messages with almost no visible body text and a single link, where an inline image doubles as both the message body and the link destination. The image is OCR'd and the extracted text is run through an NLU classifier to confirm credential-theft intent, matching lures such as fake voicemail transcripts, document-sharing notifications, and workflow addendum requests. Highly trusted sender domains that pass DMARC are excluded to reduce false positives.

Sublime rule (View on GitHub)

 1name: "Attachment: Fake email body embedded in inline image"
 2description: "Catches messages with almost no visible body text and a single link, where an inline image doubles as both the message body and the link destination. The image is OCR'd and the extracted text is run through an NLU classifier to confirm credential-theft intent, matching lures such as fake voicemail transcripts, document-sharing notifications, and workflow addendum requests. Highly trusted sender domains that pass DMARC are excluded to reduce false positives."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and regex.icount(coalesce(body.current_thread.text, ""), '[a-z0-9]') < 10
 8  and length(body.current_thread.links) == 1
 9  and length(filter(attachments,
10                    .content_disposition == "inline"
11                    and .file_type in $file_types_images
12             )
13  ) == 1
14  and any(attachments,
15          any(html.xpath(body.html, '//a[not(text())]//img/@src').nodes,
16              strings.iends_with(.raw, ..content_id)
17          )
18          and beta.ocr(.).success
19          and regex.icount(beta.ocr(.).text, '[a-zA-Z]{2,}') >= 20
20          and any(ml.nlu_classifier(beta.ocr(.).text).intents,
21                  .name == "cred_theft"
22          )
23  )
24  and any(body.current_thread.links,
25          .href_url.domain.root_domain != sender.email.domain.root_domain
26  )
27  and not (
28    sender.email.domain.root_domain in $high_trust_sender_root_domains
29    and coalesce(headers.auth_summary.dmarc.pass, false)
30  )  
31attack_types:
32  - "Credential Phishing"
33tactics_and_techniques:
34  - "Image as content"
35  - "Social engineering"
36  - "Evasion"
37detection_methods:
38  - "Optical Character Recognition"
39  - "Natural Language Understanding"
40  - "HTML analysis"
41  - "Header analysis"
42  - "Sender analysis"
43id: "c2195370-692d-5287-b28a-fa8fa2c2cdc8"
to-top