Service abuse: Zoho meeting notification callback scam

calendar Nov 3, 2026  ·
Share on: linkedin copy

Flags inbound messages sent from Zoho's meeting notification service where the body content is classified by NLU as a callback scam with medium or high confidence.

Sublime rule (View on GitHub)

 1name: "Service abuse: Zoho meeting notification callback scam"
 2description: "Flags inbound messages sent from Zoho's meeting notification service where the body content is classified by NLU as a callback scam with medium or high confidence."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.sld == "zohomeetingnotifications"
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == "callback_scam" and .confidence != "low"
10  )  
11attack_types:
12  - "Callback Phishing"
13tactics_and_techniques:
14  - "Social engineering"
15detection_methods:
16  - "Natural Language Understanding"
17  - "Sender analysis"
18id: "b2f81768-0781-5ee0-ad96-4567dfaa0b9f"
to-top