Reconnaissance: Fake-reply lure with Webex subject tag

calendar Nov 13, 2026  ·
Share on: linkedin copy

Detects inbound messages that masquerade as replies to an existing conversation (carrying an In-Reply-To header) despite having no actual prior thread history. The subjects reference scheduling calls, meetings, or follow-ups and end with a 'wbx' tag plus a random three-letter string, mimicking Webex meeting notifications. Senders vary widely, spanning free email providers and newly registered or lookalike domains, suggesting a mass-distributed social engineering tactic designed to appear as a continuation of a legitimate scheduling conversation.

Sublime rule (View on GitHub)

 1name: "Reconnaissance: Fake-reply lure with Webex subject tag"
 2description: "Detects inbound messages that masquerade as replies to an existing conversation (carrying an In-Reply-To header) despite having no actual prior thread history. The subjects reference scheduling calls, meetings, or follow-ups and end with a 'wbx' tag plus a random three-letter string, mimicking Webex meeting notifications. Senders vary widely, spanning free email providers and newly registered or lookalike domains, suggesting a mass-distributed social engineering tactic designed to appear as a continuation of a legitimate scheduling conversation."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and length(headers.in_reply_to) > 1
 8  and length(body.previous_threads) == 0
 9  and regex.imatch(subject.base, '.*-\swbx\s+[a-z]{3}\s*')  
10attack_types:
11  - "BEC/Fraud"
12  - "Spam"
13  - "Reconnaissance"
14tactics_and_techniques:
15  - "Social engineering"
16  - "Free email provider"
17  - "Spoofing"
18detection_methods:
19  - "Header analysis"
20  - "Content analysis"
21id: "67698e63-6cf6-5991-ac23-4b6e55fc4c82"
to-top