Callback phishing with online appointment abuse and distribution lists · Blog · Sublime Security

Attack Spotlight: A callback-phishing campaign used a bank's online "Request a Meeting" form and distribution-list relays to send legitimate-looking autogenerated meeting confirmations containing urgent financial language and repeated attacker-controlled phone numbers, leveraging legitimate domains to evade authentication; Sublime detected and blocked these messages using signals like mismatched context, multiple phone numbers, urgent language, commonly abused brands, and suspicious return paths.