Link: Credential phishing with cloaked content

calendar Oct 8, 2026  ·
Share on: linkedin copy

Detects emails containing a small number of links where the rendered page content is cloaked: the visible display text is classified as credential theft intent with a security/authentication theme, while the underlying page's full text is classified as benign and unrelated to security topics. The mismatch, combined with a Cloudflare Insights beacon script in the page's accessed URLs, indicates an evasive technique designed to disguise a credential harvesting page from automated analysis while presenting a convincing login-themed lure to the victim.

Sublime rule (View on GitHub)

 1name: "Link: Credential phishing with cloaked content"
 2description: "Detects emails containing a small number of links where the rendered page content is cloaked: the visible display text is classified as credential theft intent with a security/authentication theme, while the underlying page's full text is classified as benign and unrelated to security topics. The mismatch, combined with a Cloudflare Insights beacon script in the page's accessed URLs, indicates an evasive technique designed to disguise a credential harvesting page from automated analysis while presenting a convincing login-themed lure to the victim."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and 0 < length(body.current_thread.links) < 10
 8  and any(body.current_thread.links,
 9          .href_url.domain.root_domain != sender.email.domain.root_domain
10          and length(ml.link_analysis(.).final_dom.inner_text) > length(ml.link_analysis(.
11                                                                        ).final_dom.display_text
12          )
13          and length(ml.link_analysis(.).final_dom.links) == 0
14          and length(ml.link_analysis(.).final_dom.display_text) < 100
15          and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents,
16                  .name == 'cred_theft' and .confidence != 'low'
17          )
18          and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).topics,
19                  .name == 'Security and Authentication' and .confidence != 'low'
20          )
21          and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.inner_text).intents,
22                  .name == 'benign' and .confidence != 'low'
23          )
24          and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.inner_text).topics,
25                  .name not in ('Security and Authentication')
26          )
27          and any(ml.link_analysis(.).unique_urls_accessed,
28                  .domain.domain == "static.cloudflareinsights.com"
29                  and strings.contains(.path, "/beacon.min.js/")
30          )
31  )  
32attack_types:
33  - "Credential Phishing"
34tactics_and_techniques:
35  - "Evasion"
36  - "Social engineering"
37detection_methods:
38  - "URL analysis"
39  - "HTML analysis"
40  - "Natural Language Understanding"
41  - "Content analysis"
42id: "83e43bd8-1859-501e-ba15-f8359e79d00c"
to-top