Sublime Thoughts

The latest research and attack spotlights.

Get the latest

Sublime releases, detections, blogs, events, and more directly to your inbox.

You're now subscribed. Expect a monthly email from us in your inbox.

Oops! Something went wrong while submitting the form.

Attack Spotlight

Apr 1, 2025

Who are you trying to April Fool with that email scam?

Some of our favorite “worst” scam attempts from the past year

Threat Detection Team

Sublime

Attack Spotlight

Mar 27, 2025

Tycoon 2FA credential phishing with cloned internal employee login

Spoofing a corporate login for credential phishing with Tycoon 2FA

Peter Djordjevic

Detection

Attack Spotlight

Mar 20, 2025

Microsoft OAuth URL used as redirect to AITM credential phishing site

Limited scope Microsoft OAuth request used to blend in as legitimate traffic, redirecting the user to an AITM credential phishing site

Brandon Murphy

Detection

Attack Spotlight

Mar 13, 2025

Seeing both sides of a service abuse financial fraud using YOPmail disposable messages

Callback phishing attack abusing Adobe Creative Cloud, Microsoft 365, and YOPmail

Josh "Soup" Campbell

Detection

Attack Spotlight

Mar 6, 2025

Base64-encoding an SVG attack within an iframe and hiding it all in an EML attachment

Credential phishing with nested attachments and a base64-encoded attack within an iframe

Sam Scholten

Detection

Attack Spotlight

Feb 25, 2025

Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics

Embedding malicious JS code within SVGs to deliver adversary in the middle credential phishing attacks.

Brandon Murphy

Detection

Attack Spotlight

Feb 18, 2025

Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits

Bad actors will try to blend their attacks in with other tax time emails in order to evade detection. These are some of the tactics we’ve already seen this year.

Brandon Webster

Detection

Machine Learning

Feb 7, 2025

Email Topic Modeling: Simplifying detection with ML-powered granularity

Topic Modeling is a machine learning-powered topic detection function that automatically classifies message content into predefined categories.

Aryan Luthra

ML Researcher

Attack Spotlight

Jan 29, 2025

Credential phishing Charles Schwab account holders with 2FA bypass

Credential phishing attempt impersonating Charles Schwab to steal login credentials and two-factor code.

Aiden Mitchell

Detection

Sublime Thoughts

Who are you trying to April Fool with that email scam?

Some of our favorite “worst” scam attempts from the past year

Tycoon 2FA credential phishing with cloned internal employee login

Spoofing a corporate login for credential phishing with Tycoon 2FA

Microsoft OAuth URL used as redirect to AITM credential phishing site

Limited scope Microsoft OAuth request used to blend in as legitimate traffic, redirecting the user to an AITM credential phishing site

Seeing both sides of a service abuse financial fraud using YOPmail disposable messages

Callback phishing attack abusing Adobe Creative Cloud, Microsoft 365, and YOPmail

Base64-encoding an SVG attack within an iframe and hiding it all in an EML attachment

Credential phishing with nested attachments and a base64-encoded attack within an iframe

Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics

Embedding malicious JS code within SVGs to deliver adversary in the middle credential phishing attacks.

Tax season email attacks: AdWind RATs and Tycoon 2FA phishing kits

Bad actors will try to blend their attacks in with other tax time emails in order to evade detection. These are some of the tactics we’ve already seen this year.

Email Topic Modeling: Simplifying detection with ML-powered granularity

Topic Modeling is a machine learning-powered topic detection function that automatically classifies message content into predefined categories.

Credential phishing Charles Schwab account holders with 2FA bypass

Credential phishing attempt impersonating Charles Schwab to steal login credentials and two-factor code.

Now is the time.