Stripe invoice abuse

calendar Jul 14, 2026  ·
Share on: linkedin copy

A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Sublime rule (View on GitHub)

 1name: "Stripe invoice abuse"
 2description: |
 3  A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service.
 4  Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. 
 5  The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and sender.email.domain.root_domain == "stripe.com"
11  and headers.auth_summary.dmarc.pass
12  and (
13    (
14      length(attachments) == 2
15      and any(attachments,
16              .file_extension == "pdf"
17              and any(file.explode(.),
18                      4 of (
19                        strings.ilike(.scan.ocr.raw, "*Btc Purchase*"),
20                        strings.ilike(.scan.ocr.raw, "*suspicious activity*"),
21                        strings.ilike(.scan.ocr.raw,
22                                      "*get in touch with us straight once*"
23                        ),
24                        strings.ilike(.scan.ocr.raw, "*your phone number*"),
25                        strings.ilike(.scan.ocr.raw, "*due deducted*"),
26                        strings.ilike(.scan.ocr.raw,
27                                      "*merchant security service center*"
28                        )
29                      )
30              )
31      )
32    )
33    or (
34      any(ml.nlu_classifier(body.current_thread.text).intents,
35          .name == "callback_scam" and .confidence == "high"
36      )
37      and 2 of (
38        strings.icontains(body.current_thread.text, "processing your payment"),
39        strings.icontains(body.current_thread.text, "payment has been received"),
40        strings.icontains(body.current_thread.text, "order status update"),
41        strings.icontains(body.current_thread.text, "ship your items"),
42        strings.icontains(body.current_thread.text, "reach out:"),
43        strings.icontains(body.current_thread.text, "pay this invoice"),
44        strings.icontains(body.current_thread.text, "dear"),
45        strings.icontains(body.current_thread.text, "need to cancel"),
46        strings.icontains(body.current_thread.text, "Яеոеԝаⅼ"),
47        strings.icontains(body.current_thread.text, "order confirmation"),
48      )
49    )
50  )  
51attack_types:
52  - "BEC/Fraud"
53  - "Callback Phishing"
54tactics_and_techniques:
55  - "PDF"
56detection_methods:
57  - "File analysis"
58  - "Header analysis"
59id: "90162d16-0311-579f-b256-b501ca29bb35"
to-top