Service abuse: FormAssembly notifications with suspicious links

calendar Nov 13, 2026  ·
Share on: linkedin copy

Detects inbound messages containing legitimate-looking FormAssembly order and form-response notifications that have been abused to inject scam lures pointing to suspicious links. The messages mimic genuine automated notifications but contain embedded text promoting fake priority gateways, VIP passcodes, or ticket/voucher claims designed to lure recipients into visiting attacker-controlled pages.

Sublime rule (View on GitHub)

 1name: "Service abuse: FormAssembly notifications with suspicious links"
 2description: "Detects inbound messages containing legitimate-looking FormAssembly order and form-response notifications that have been abused to inject scam lures pointing to suspicious links. The messages mimic genuine automated notifications but contain embedded text promoting fake priority gateways, VIP passcodes, or ticket/voucher claims designed to lure recipients into visiting attacker-controlled pages."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "formassembly.com"
 8  and any($free_subdomain_hosts, strings.icontains(body.current_thread.text, .))  
 9attack_types:
10  - "Spam"
11  - "Credential Phishing"
12tactics_and_techniques:
13  - "Free subdomain host"
14  - "Social engineering"
15  - "Impersonation: Brand"
16detection_methods:
17  - "Content analysis"
18  - "URL analysis"
19  - "Sender analysis"
20id: "db389a52-90bb-56db-bee6-a4246e1a6cc6"
to-top