High Volume Spoofed Email with Credential Harvesting Indicators

Ankit Mehta@Secvyn

•updated Jun 16, 2026•2•0•6

Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.