VIP impersonation: VIP payment redirect handoff via fake threads

calendar Jul 8, 2026  ·
Share on: linkedin copy

Detects inbound messages where an external sender, absent from the original conversation, targets a single internal recipient after a VIP previously instructed that party to handle invoice or payment correspondence. The rule identifies prior threads where a known VIP explicitly redirected billing or payment contact to an internal address — using language such as forwarding instructions, accounts payable references, or billing handoff phrasing — and flags follow-up messages from external senders who are no longer accompanied by the VIP. NLU classifiers confirm financial context in the prior thread. This pattern is consistent with adversaries monitoring or fabricating invoice-related threads to insert themselves at the point of payment handoff.

Sublime rule (View on GitHub)

 1name: "VIP impersonation: VIP payment redirect handoff via fake threads"
 2description: "Detects inbound messages where an external sender, absent from the original conversation, targets a single internal recipient after a VIP previously instructed that party to handle invoice or payment correspondence. The rule identifies prior threads where a known VIP explicitly redirected billing or payment contact to an internal address — using language such as forwarding instructions, accounts payable references, or billing handoff phrasing — and flags follow-up messages from external senders who are no longer accompanied by the VIP. NLU classifiers confirm financial context in the prior thread. This pattern is consistent with adversaries monitoring or fabricating invoice-related threads to insert themselves at the point of payment handoff."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(map(filter(body.previous_threads,
 8                     // VIP authored the segment: display_name OR real email (OR, not AND -- the actor guesses
 9                     // the exec's address, so a fabricated From: is often the wrong format at the right org).
10                     any($org_vips,
11                         strings.icontains(..sender.display_name, .display_name)
12                         or (
13                           .email != ""
14                           and strings.icontains(..sender.email.email, .email)
15                         )
16                     )
17                     // skip auto-replies; coalesce the null on subject-less segments before `not`.
18                     and not coalesce(.subject.is_auto_reply, false)
19                     // the live recipient is the payee the VIP names, at an org domain.
20                     and any(recipients.to,
21                             .email.email != ..sender.email.email
22                             and .email.domain.root_domain in $org_domains
23                             and strings.icontains(..text, .email.email)
24                     )
25                     // payment "handoff" phrasing.
26                     and regex.icontains(.text,
27                                         'accounts? payable',
28                                         '(?:forward|send|rout|direct|remit|submit|issue) it (?:directly )?to',
29                                         '(?:forward|send|direct|remit|submit|route) (?:the |all |related )?(?:invoice|correspondence|payment|billing)',
30                                         'for payment processing,? please contact',
31                                         '(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
32                                         '(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
33                                         'billing (?:contact|correspondence|team|department)'
34                     )
35              ),
36              .sender.email.email
37          ),
38          . != ""
39          // the VIP is no longer present in the live message.
40          and not strings.icontains(sender.email.email, .)
41          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
42                      strings.icontains(.email.email, ..)
43          )
44          // any previous thread authored by the "VIP" has invoice/payment
45          and any(filter(body.previous_threads, .sender.email.email == ..),
46                  any(ml.nlu_classifier(.text, subject=.subject.base).tags,
47                      .name in ("invoice", "payment") and .confidence != "low"
48                  )
49                  or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
50                         .name in (
51                           "Request to View Invoice",
52                           "Payment Information"
53                         )
54                         and .confidence != "low"
55                  )
56          )
57  )
58  // exactly one org-domain recipient (the payee); external sender.
59  and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
60                    .email.domain.root_domain in $org_domains
61             )
62  ) == 1
63  and not sender.email.domain.root_domain in $org_domains  
64attack_types:
65  - "BEC/Fraud"
66tactics_and_techniques:
67  - "Impersonation: VIP"
68  - "Social engineering"
69detection_methods:
70  - "Content analysis"
71  - "Natural Language Understanding"
72  - "Sender analysis"
73  - "Header analysis"
74id: "215b8849-c7b5-577c-844f-be0e0dfc9116"
to-top