Service abuse: Google callback scam

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects inbound messages spoofing Google's no-reply notification address where the body content is classified by the NLU engine as having callback scam intent with medium or high confidence.

Sublime rule (View on GitHub)

 1name: "Service abuse: Google callback scam"
 2description: "Detects inbound messages spoofing Google's no-reply notification address where the body content is classified by the NLU engine as having callback scam intent with medium or high confidence."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == "no-reply@accounts.google.com"
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == "callback_scam" and .confidence != "low"
10  )  
11attack_types:
12  - "Callback Phishing"
13tactics_and_techniques:
14  - "Impersonation: Brand"
15  - "Spoofing"
16  - "Social engineering"
17detection_methods:
18  - "Natural Language Understanding"
19  - "Sender analysis"
20id: "1d1c3273-6735-57ed-a1e6-b1ac988bfc7d"
to-top