Surge in callback phishing attacks abusing auto notifications, verifications, alerts, receipts, and more · Blog · Sublime Security

This Attack Spotlight details active callback-phishing campaigns that leverage legitimate cloud services and notification templates (Apple, Amazon SNS/Budgets, Grammarly, e-commerce receipts) to insert phone numbers and social-engineering text into messages delivered to distribution lists, increasing reach and evading traditional security; the report includes example payloads, detection signals (e.g., callback phishing in address fields, distribution list delivery, financial urgency), and mitigation recommendations such as input validation, template hardening, limiting free-trial features, and red-team testing.