VIP impersonation: Payment handoff with VIP display name authored fake threads

calendar Aug 10, 2026  ·
Share on: linkedin copy

Detects inbound messages where an external sender, absent from the original conversation, targets a single internal recipient after a VIP previously instructed that party to handle invoice or payment correspondence. The rule identifies prior threads where a known VIP explicitly redirected billing or payment contact to an internal address — using language such as forwarding instructions, accounts payable references, or billing handoff phrasing — and flags follow-up messages from external senders who are no longer accompanied by the VIP. NLU classifiers confirm financial context in the prior thread. This pattern is consistent with adversaries monitoring or fabricating invoice-related threads to insert themselves at the point of payment handoff.

Sublime rule (View on GitHub)

 1name: "VIP impersonation: Payment handoff with VIP display name authored fake threads"
 2description: "Detects inbound messages where an external sender, absent from the original conversation, targets a single internal recipient after a VIP previously instructed that party to handle invoice or payment correspondence. The rule identifies prior threads where a known VIP explicitly redirected billing or payment contact to an internal address — using language such as forwarding instructions, accounts payable references, or billing handoff phrasing — and flags follow-up messages from external senders who are no longer accompanied by the VIP. NLU classifiers confirm financial context in the prior thread. This pattern is consistent with adversaries monitoring or fabricating invoice-related threads to insert themselves at the point of payment handoff."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // note to rule writers
 7  // this rule has a related rule which covers the same logic, but handles the "email address" but no display name in preivous threads
 8  // very likely the logic will need updated in the corresponding rule
 9  // see vip_impersonation_fake_thread_with_invoice_handoff_email.yml
10  type.inbound
11  and any(map(filter(body.previous_threads,
12                     .sender.email.email == ""
13                     and .sender.display_name != ""
14                     and any($org_vips,
15                             strings.icontains(..sender.display_name,
16                                               .display_name
17                             )
18                     )
19                     and not coalesce(.subject.is_auto_reply, false)
20                     and any(recipients.to,
21                             .email.domain.root_domain in $org_domains
22                             and strings.icontains(..text, .email.email)
23                     )
24                     // payment "handoff" phrasing.
25                     and regex.icontains(.text,
26                                         'accounts? payable',
27                                         '(?:forward|send|rout|direct|remit|submit|issue) (?:it|a copy) (?:directly )?to',
28                                         '(?:forward|send|direct|remit|submit|route) (?:the |all |related |for )?(?:invoice|correspondence|payment|billing|processing)',
29                                         'for payment processing,? please contact',
30                                         '(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
31                                         '(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
32                                         'billing (?:contact|correspondence|team|department)',
33                                         'a copy.{0,20}sent to',
34                     )
35              ),
36              .sender.display_name
37          ),
38          . != ""
39          // any previous thread authored by the "VIP" has invoice/payment
40          and (
41            any(filter(body.previous_threads, .sender.email.email == ..),
42                any(ml.nlu_classifier(.text, subject=.subject.base).tags,
43                    .name in ("invoice", "payment") and .confidence != "low"
44                )
45                or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
46                       .name in ("Request to View Invoice", "Payment Information")
47                       and .confidence != "low"
48                )
49            )
50            // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
51            or any(attachments,
52                   strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
53            )
54          )
55          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
56                      any($org_vips,
57                          strings.icontains(..., .display_name)
58                          and .email != ""
59                          and strings.icontains(..email.email, .email)
60                      )
61          )
62  )
63  and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
64                    .email.domain.root_domain in $org_domains
65             )
66  ) == 1
67  and not (
68    sender.email.domain.root_domain in $org_domains
69    and coalesce(headers.auth_summary.dmarc.pass, false)
70  )  
71attack_types:
72  - "BEC/Fraud"
73tactics_and_techniques:
74  - "Impersonation: VIP"
75  - "Social engineering"
76detection_methods:
77  - "Content analysis"
78  - "Natural Language Understanding"
79  - "Sender analysis"
80  - "Header analysis"
81id: "43180f2d-8cf7-5af0-9963-2c9634734c8d"
to-top