Service abuse: Coursera callback scam

calendar Jul 21, 2026  ·
Share on: linkedin copy

Detects inbound messages spoofing Coursera transactional notifications - such as email confirmation requests or account change alerts - sent from Coursera's legitimate sending infrastructure, but targeting recipients on newly registered domains or containing mailto links pointing to newly registered non-Coursera domains. The combination of authentic-looking Coursera branding with anomalous recipient or embedded contact domains suggests account takeover or credential harvesting activity targeting Coursera users.

Sublime rule (View on GitHub)

 1name: "Service abuse: Coursera callback scam"
 2description: "Detects inbound messages spoofing Coursera transactional notifications - such as email confirmation requests or account change alerts - sent from Coursera's legitimate sending infrastructure, but targeting recipients on newly registered domains or containing mailto links pointing to newly registered non-Coursera domains. The combination of authentic-looking Coursera branding with anomalous recipient or embedded contact domains suggests account takeover or credential harvesting activity targeting Coursera users."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // message is sent from coursera (auth doesn't really matter here)
 8  and sender.email.domain.root_domain == "coursera.org"
 9  and (
10    // the email being changed appears in the body as a link
11    any(body.links,
12        .href_url.scheme == "mailto"
13        and .href_url.domain.root_domain != "coursera.org"
14        // the domain is newly registered
15        and network.whois(.href_url.domain).days_old < 365
16    )
17    // in other cases the email address isn't in the email body and it's only as a rcpt
18    or network.whois(recipients.to[0].email.domain).days_old < 365
19    // extract the first line and do NLU on it
20    or any(ml.nlu_classifier(regex.extract(body.current_thread.text,
21                                           '^(?P<first_line>[^\n]+)\n'
22                             )[0].named_groups["first_line"]
23           ).intents,
24           .name == "callback_scam" and .confidence == "high"
25    )
26  )
27  // not in org_domains
28  and all(recipients.to, .email.domain.domain not in $org_domains)  
29attack_types:
30  - "Callback Phishing"
31tactics_and_techniques:
32  - "Impersonation: Brand"
33  - "Lookalike domain"
34  - "Social engineering"
35detection_methods:
36  - "Sender analysis"
37  - "URL analysis"
38  - "Whois"
39id: "ea4293c3-8b11-58ba-85f0-0a03af2b21ed"
to-top