Service abuse: Freshbooks callback scam

calendar Oct 21, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from the freshbooks.com root domain where the body text is classified by an NLU model as containing callback scam intent with medium or high confidence. This identifies legitimate Freshbooks infrastructure being abused to deliver callback scam lures.

Sublime rule (View on GitHub)

 1name: "Service abuse: Freshbooks callback scam"
 2description: "Detects inbound messages sent from the freshbooks.com root domain where the body text is classified by an NLU model as containing callback scam intent with medium or high confidence. This identifies legitimate Freshbooks infrastructure being abused to deliver callback scam lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "freshbooks.com"
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == "callback_scam" and .confidence != "low"
10  )   
11attack_types:
12  - "Callback Phishing"
13tactics_and_techniques:
14  - "Social engineering"
15detection_methods:
16  - "Natural Language Understanding"
17  - "Sender analysis"
18id: "0e1c63a3-689a-5d88-a49c-0db024fa4b78"
to-top