Service abuse: Apple callback scam

calendar Sep 29, 2026  ·
Share on: linkedin copy

Detects inbound messages spoofing Apple's automated notification address where the reply-to domain diverges from apple.com, combined with a natural language understanding classifier identifying callback scam intent in the message body with medium or high confidence.

Sublime rule (View on GitHub)

 1name: "Service abuse: Apple callback scam"
 2description: "Detects inbound messages spoofing Apple's automated notification address where the reply-to domain diverges from apple.com, combined with a natural language understanding classifier identifying callback scam intent in the message body with medium or high confidence."
 3type: "rule"
 4severity: "medium"
 5source: |
 6    type.inbound
 7    and sender.email.email == "noreply@email.apple.com"
 8    and any(headers.reply_to, .email.domain.root_domain != "apple.com")
 9    and any(ml.nlu_classifier(body.current_thread.text).intents,
10            .name == "callback_scam" and .confidence != "low"
11    )    
12attack_types:
13  - "Callback Phishing"
14tactics_and_techniques:
15  - "Social engineering"
16  - "Out of band pivot"
17detection_methods:
18  - "Sender analysis"
19  - "Header analysis"
20  - "Natural Language Understanding"
21id: "0cddb6d4-6c72-59ad-8d99-272c99c36fa4"
to-top