HTML: Template placeholders or recipient email in element class attributes

 1name: "HTML: Template placeholders or recipient email in element class attributes"
 2description: "Detects inbound messages where HTML element class attributes contain either unfilled template placeholders (e.g., {email}, {RECIPIENT_EMAIL}, {domain}) or the recipient's actual email address — optionally wrapped in curly braces. This pattern indicates a bulk-sending infrastructure that failed to substitute personalization tokens, or one that embeds recipient identifiers directly into HTML class names for tracking or evasion purposes. Observed samples follow a consistent pattern: subjects contain numeric identifiers flanking the recipient's email address, and senders vary across unrelated domains, suggesting a coordinated operation targeting multiple organizations including technology and fitness brands."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    // observed unpopulated template variables in class names
 9    any(html.xpath(body.html, "//*/@class").nodes,
10        strings.contains(.raw, '{')
11        and strings.contains(.raw, '}')
12        and regex.icontains(.raw,
13                            '\{\s*(?:domain|email|(?:RECIPIENT|SENDER)[_\s]?EMAIL)\s*\}'
14        )
15    )
16  
17    // check where class names _are_ the email address, or contain the email address are wrapped in { } or start/end with { or }
18    or any(recipients.to,
19           .email.email != ""
20           and any(html.xpath(body.html, "//*/@class").nodes,
21                   .raw =~ ..email.email
22                   or .raw =~ strings.concat("{", ..email.email, "}")
23                   or .raw =~ strings.concat("{", ..email.email)
24                   or .raw =~ strings.concat(..email.email, "}")
25           )
26    )
27  )  
28attack_types:
29  - "Credential Phishing"
30  - "BEC/Fraud"
31tactics_and_techniques:
32  - "Evasion"
33  - "Social engineering"
34detection_methods:
35  - "HTML analysis"
36  - "Content analysis"
37id: "e7d0fb39-7a12-5a14-8041-245cc74a9320"