Service abuse: Conceptboard VIP impersonation lure

calendar Oct 9, 2026  ·
Share on: linkedin copy

Detects inbound emails from conceptboard.com where the message body references an organizational VIP's display name paired with the phrase 'wants to work with you,' indicating the legitimate collaboration platform is being abused to impersonate a VIP and lure recipients into engaging with a fraudulent workspace invitation.

Sublime rule (View on GitHub)

 1name: "Service abuse: Conceptboard VIP impersonation lure"
 2description: "Detects inbound emails from conceptboard.com where the message body references an organizational VIP's display name paired with the phrase 'wants to work with you,' indicating the legitimate collaboration platform is being abused to impersonate a VIP and lure recipients into engaging with a fraudulent workspace invitation."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "conceptboard.com"
 8  and any($org_vips,
 9          strings.icontains(body.current_thread.text,
10                            strings.concat(.display_name,
11                                           " wants to work with you"
12                            )
13          )
14  )  
15attack_types:
16  - "BEC/Fraud"
17  - "Spam"
18tactics_and_techniques:
19  - "Impersonation: VIP"
20  - "Social engineering"
21detection_methods:
22  - "Content analysis"
23  - "Sender analysis"
24id: "cdd0bc57-0eca-5a79-8479-90bc9d54cbca"
to-top