Service abuse: Upwork callback scam

calendar Oct 22, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from Upwork's root domain where NLU classification of the thread body identifies callback scam intent with medium or high confidence, indicating the platform is being abused to lure recipients into calling a fraudulent number.

Sublime rule (View on GitHub)

 1name: "Service abuse: Upwork callback scam"
 2description: "Detects inbound messages sent from Upwork's root domain where NLU classification of the thread body identifies callback scam intent with medium or high confidence, indicating the platform is being abused to lure recipients into calling a fraudulent number."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "upwork.com"
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == "callback_scam" and .confidence != "low"
10  )  
11attack_types:
12  - "Callback Phishing"
13tactics_and_techniques:
14  - "Social engineering"
15  - "Out of band pivot"
16detection_methods:
17  - "Natural Language Understanding"
18  - "Sender analysis"
19id: "2651d5eb-806f-5d9b-9b16-c47697838bc3"
to-top