Link: Credential phishing with obfuscated JavaScript redirect

calendar Aug 21, 2026  ·
Share on: linkedin copy

Flags inbound messages where the current thread contains between 1 and 9 links and NLU classification identifies credential theft intent with at least medium confidence. Additionally requires that aggressive link analysis reveal a redirect chain containing a query parameter with an obfuscated JavaScript payload that uses an onerror handler combined with atob and decodeURIComponent to dynamically redirect the browser, a technique commonly used to evade static URL scanning while ultimately routing victims to a credential harvesting page.

Sublime rule (View on GitHub)

 1name: "Link: Credential phishing with obfuscated JavaScript redirect"
 2description: "Flags inbound messages where the current thread contains between 1 and 9 links and NLU classification identifies credential theft intent with at least medium confidence. Additionally requires that aggressive link analysis reveal a redirect chain containing a query parameter with an obfuscated JavaScript payload that uses an onerror handler combined with atob and decodeURIComponent to dynamically redirect the browser, a technique commonly used to evade static URL scanning while ultimately routing victims to a credential harvesting page."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and 0 < length(body.current_thread.links) < 10
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == 'cred_theft' and .confidence != 'low'
10  )
11  and any(body.current_thread.links,
12          any(ml.link_analysis(., mode="aggressive").redirect_history,
13              any(flatten(values(.query_params_decoded)),
14                  strings.icontains(.,
15                                    'onerror="window.location=decodeURIComponent(atob('
16                  )
17              )
18          )
19  )  
20attack_types:
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Open redirect"
24  - "Evasion"
25  - "Scripting"
26  - "Social engineering"
27detection_methods:
28  - "Natural Language Understanding"
29  - "URL analysis"
30  - "Javascript analysis"
31id: "cc585e3d-113c-53d1-9212-d966f0e4d94c"
to-top