Credential phishing: Financial lure via ActiveCampaign infrastructure

 1name: "Credential phishing: Financial lure via ActiveCampaign infrastructure"
 2description: "Detects inbound phishing messages sent via ActiveCampaign using identifiable infrastructure fingerprints and hidden boilerplate text. Covers a wide range of lure themes including credit cards, loans, deposits, account updates, and vague document or verification prompts. Requires NLU Financial Communications topic classification."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(headers.mailer, "ActiveCampaign")
 8  and (
 9    strings.ilike(body.html.inner_text,
10                  "*Piratini*",
11                  "*45.405.898/0001-16*",
12                  "*Cancelar inscri*",
13                  "*Matem?tica Genial*",
14                  "*BMIGLLC*"
15    )
16    or strings.ilike(body.html.raw,
17                     "*belonging to Spun*",
18                     "*affiliated with Spun*"
19    )
20  )
21  and (
22    length(html.xpath(body.html,
23                      '//*[contains(@style, "background") and contains(@style, "padding")] | //a[contains(@class, "es-button")]'
24           ).nodes
25    ) > 0
26    or length(html.xpath(body.html, '//a/img').nodes) > 0
27  )
28  and ml.nlu_classifier(body.current_thread.text).language == "english"
29  and not any(ml.nlu_classifier(body.current_thread.text).topics,
30              .name in ("Health and Wellness", "Entertainment and Sports")
31              and .confidence == "high"
32  )
33  and not (
34    sender.email.domain.root_domain in $high_trust_sender_root_domains
35    and coalesce(headers.auth_summary.dmarc.pass, false)
36  )  
37attack_types:
38  - "Credential Phishing"
39tactics_and_techniques:
40  - "Social engineering"
41detection_methods:
42  - "Content analysis"
43  - "Header analysis"
44  - "Natural Language Understanding"
45  - "Sender analysis"
46id: "8b18a6eb-fc61-55d0-be68-c397bddfa3bd"