Brand impersonation: Chase Bank

Impersonation of Chase Bank and related services to harvest credentials or related information such as dates of birth, phone numbers, social security numbers, ATM pin numbers, drivers license numbers, selfies, and ID card photos.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Chase Bank"
 2description: |
 3  Impersonation of Chase Bank and related services to harvest credentials or related information 
 4  such as dates of birth, phone numbers, social security numbers, ATM pin numbers, drivers license 
 5  numbers, selfies, and ID card photos.  
 6references:
 7  - "https://cyware.com/news/new-phishing-scam-impersonating-chase-bank-asks-for-sensitive-data-including-selfies-53065228"
 8type: "rule"
 9severity: "high"
10source: |
11  type.inbound
12  and (
13    strings.ilike(sender.display_name,
14                  '*chase sapphire*',
15                  '*chase card services*',
16                  '*united mileageplus*',
17                  "echase*"
18    )
19    or strings.ilevenshtein(sender.display_name, 'chase sapphire') <= 2
20    or strings.ilevenshtein(sender.display_name, 'chase card services') <= 2
21    or strings.ilevenshtein(sender.display_name, 'united mileageplus') <= 2
22    or (
23      (
24        strings.ilevenshtein(sender.display_name, 'echase') <= 1
25        or (
26          strings.icontains(sender.display_name, "bank")
27          and strings.icontains(subject.base, "chase bank")
28        )
29      )
30      // Negate Chase sender display name if cred theft, callback phishing, and a Chase logo isn't detected
31      and not (
32        strings.icontains(sender.display_name, 'chase')
33        and not (
34          any(ml.nlu_classifier(body.current_thread.text).intents,
35              .name == "cred_theft" and .confidence in ("medium", "high")
36          )
37          or any(ml.nlu_classifier(body.current_thread.text).intents,
38                 .name == "callback_scam" and .confidence in ("medium", "high")
39          )
40          or any(ml.logo_detect(beta.message_screenshot()).brands,
41                 strings.starts_with(.name, "Chase")
42          )
43        )
44      )
45    )
46    or regex.icontains(body.current_thread.text,
47                        '(Chase|J\.?\s?P\.?\sMorgan)\s(Privacy|Treasury)\sOperations|(Privacy|Treasury)\sOperations\s(Chase|J\.?\s?P\.?\sMorgan)'
48    )
49  )
50  and not (
51    sender.display_name is not null and sender.display_name in~ ("chaser", "case")
52  )
53  and sender.email.domain.root_domain not in~ ('chase.com', 'united.com', 'transunion.com', 'shopping-chase.com', 'chasetravel.com')
54  and (
55    profile.by_sender().prevalence in ("new", "outlier")
56    or (
57      profile.by_sender().any_messages_malicious_or_spam
58      and not profile.by_sender().any_messages_benign
59    )
60  )
61
62  // negate highly trusted sender domains unless they fail DMARC authentication
63  and (
64    (
65      sender.email.domain.root_domain in $high_trust_sender_root_domains
66      and not headers.auth_summary.dmarc.pass
67    )
68    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
69  )
70  // and not solicited
71  and not profile.by_sender().solicited  
72attack_types:
73  - "Credential Phishing"
74tactics_and_techniques:
75  - "Impersonation: Brand"
76  - "Lookalike domain"
77  - "Social engineering"
78detection_methods:
79  - "Header analysis"
80  - "Sender analysis"
81id: "c680f1e7-01b9-5b95-897b-65957f4a57aa"
to-top