Link: Credential phishing with visit-tracking script

calendar Sep 25, 2026  ·
Share on: linkedin copy

Flags inbound messages where the message body is classified as credential theft with medium or high confidence, and where at least one linked page's rendered DOM contains a script that generates a unique visitor token (via Date.now() and Math.random() concatenation) and uses it to beacon back through a dynamically created Image object, a common pattern for tracking link clicks or victim visits in phishing infrastructure.

Sublime rule (View on GitHub)

 1name: "Link: Credential phishing with visit-tracking script"
 2description: "Flags inbound messages where the message body is classified as credential theft with medium or high confidence, and where at least one linked page's rendered DOM contains a script that generates a unique visitor token (via Date.now() and Math.random() concatenation) and uses it to beacon back through a dynamically created Image object, a common pattern for tracking link clicks or victim visits in phishing infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).intents,
 8          .name == 'cred_theft' and .confidence != 'low'
 9  )
10  and any(body.current_thread.links,
11          any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
12                         "//script"
13              ).nodes,
14              // unique visit token
15              regex.icontains(.raw,
16                              'Date\.now\(\)\.toString\(36\)\s*\+\s*Math\.random\(\)\.toString\(36\)\.slice\(2'
17              )
18              and strings.icontains(.raw, 'new Image();')
19              and regex.icontains(.raw, '.src=[a-z][+]')
20          )
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Scripting"
26  - "Evasion"
27detection_methods:
28  - "Natural Language Understanding"
29  - "URL analysis"
30  - "HTML analysis"
31  - "Javascript analysis"
32id: "b87bdcb1-6838-5db8-a695-15e137da4fed"
to-top