Link: Mismatched Shopify template button href

calendar Aug 20, 2026  ·
Share on: linkedin copy

Flags inbound messages where the sender's display name contains a space and the HTML body includes a styled table cell with a linked button whose title attribute reveals a leftover Shopify CDN file path, but the button's actual href does not point to that same path on cdn.shopify.com. This mismatch suggests a hijacked or repurposed Shopify email template being used to redirect recipients to an unintended destination. Messages from highly trusted sender domains that pass DMARC authentication are excluded.

Sublime rule (View on GitHub)

 1name: "Link: Mismatched Shopify template button href"
 2description: "Flags inbound messages where the sender's display name contains a space and the HTML body includes a styled table cell with a linked button whose title attribute reveals a leftover Shopify CDN file path, but the button's actual href does not point to that same path on cdn.shopify.com. This mismatch suggests a hijacked or repurposed Shopify email template being used to redirect recipients to an unintended destination. Messages from highly trusted sender domains that pass DMARC authentication are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.icontains(sender.display_name, ' ')
 8  and any(html.xpath(body.html,
 9                     '//td[contains(@style, "background-color")]//a[@title and @href]'
10          ).nodes,
11          // the leftover template title advertises a shopify file path...
12          any(regex.iextract(.raw,
13                             'title="https://cdn\.shopify\.com(?P<tpath>/s/files/\d+/\d+/\d+/\d+/)'
14              ),
15              // ...that the button's actual href doesn't point to
16              not any(..links,
17                      .href_url.domain.domain == "cdn.shopify.com"
18                      and strings.istarts_with(.href_url.path,
19                                               ..named_groups["tpath"]
20                      )
21              )
22          )
23  )
24  // negate highly trusted sender domains unless they fail DMARC authentication
25  and not (
26    sender.email.domain.root_domain in $high_trust_sender_root_domains
27    and coalesce(headers.auth_summary.dmarc.pass, false)
28  )  
29attack_types:
30  - "Credential Phishing"
31tactics_and_techniques:
32  - "Evasion"
33  - "Social engineering"
34detection_methods:
35  - "HTML analysis"
36  - "URL analysis"
37  - "Header analysis"
38  - "Sender analysis"
39id: "a8bfb89e-976e-5437-b8c7-a6db1c73a82b"
to-top