From 8bc9eca3cf82b90bfafdc06711443930d35e3ba6 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Wed, 1 Apr 2026 09:42:37 -0400
Subject: [PATCH] feat: detect sextortion/phishing by subject pattern, explain
 why spam score is 0, actionable remediation

---
 app/admin/sync/mimecast/page.tsx | 57 ++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/app/admin/sync/mimecast/page.tsx b/app/admin/sync/mimecast/page.tsx
index fd1d2c4..1411c9e 100644
--- a/app/admin/sync/mimecast/page.tsx
+++ b/app/admin/sync/mimecast/page.tsx
@@ -983,15 +983,72 @@ function HeldMailTab() {
 }
 
 // ── Delivered Mail Tab ────────────────────────────────────────────────────────
+// Known phishing/scam subject patterns
+const SEXTORTION_PATTERNS = [
+  /you pervert/i, /i recorded you/i, /i have your password/i, /i hacked your/i,
+  /your device was hacked/i, /your camera was/i, /rat (software|trojan)/i,
+  /pay .{0,20}bitcoin/i, /send .{0,20}btc/i, /your (intimate|private|sexual) (video|footage|content)/i,
+  /i have access to your/i, /you visited (adult|porn|xxx)/i,
+];
+
+const PHISHING_PATTERNS = [
+  /verify your account/i, /your account (has been|will be) (suspended|terminated|closed|locked)/i,
+  /click here to (verify|confirm|restore|unlock|reactivate)/i,
+  /unusual (sign|login|activity) (in|on|detected)/i,
+  /update your (billing|payment|credit card) (info|information|details)/i,
+  /you have (won|been selected|been chosen)/i,
+  /claim your (prize|reward|gift card)/i,
+  /wire transfer/i, /urgent (action|response) (required|needed)/i,
+  /your (order|package|parcel|shipment) (is|has been) (held|delayed|pending)/i,
+];
+
+function detectSubjectThreat(subject: string): 'sextortion' | 'phishing' | null {
+  const s = subject ?? '';
+  if (SEXTORTION_PATTERNS.some(p => p.test(s))) return 'sextortion';
+  if (PHISHING_PATTERNS.some(p => p.test(s))) return 'phishing';
+  return null;
+}
+
 function analyzeDelivered(m: any): { headline: string; explanation: string; severity: 'high' | 'medium' | 'low'; actions: AnalysisAction[] } {
   const score: number = m.spamScore ?? 0;
   const level: string = (m.detectionLevel ?? '').toLowerCase();
   const status: string = (m.status ?? '').toLowerCase();
   const from: string = m.from ?? '';
+  const subject: string = m.subject ?? '';
   const fromDomain = from.includes('@') ? from.split('@')[1] : from;
   const fromEnvDomain = m.fromEnv?.includes('@') ? m.fromEnv.split('@')[1] : '';
   const envelopeMismatch = fromEnvDomain && fromDomain && fromEnvDomain !== fromDomain;
 
+  // Subject-based threat detection — catches zero-score phishing/sextortion
+  const subjectThreat = detectSubjectThreat(subject);
+  if (subjectThreat === 'sextortion') {
+    return {
+      headline: 'Sextortion Scam — Bypassed Spam Filter',
+      severity: 'high',
+      explanation: `This is a known sextortion scam pattern. Despite a spam score of ${score}, these emails evade spam filters because they use plain text (no links or attachments), send from free email providers like Gmail with good sender reputation (${fromDomain}), and send individually rather than in bulk — all of which make them invisible to volume-based spam detection. The sender has no actual recordings or access; this is a social engineering attempt to extort payment, typically in cryptocurrency.`,
+      actions: [
+        { label: 'Block this sender immediately', description: `Add "${from}" to Mimecast > Administration > Gateway > Policies > Blocked Senders. Also add the domain "${fromDomain}" if it is not a legitimate provider.`, type: 'info', warning: true },
+        { label: 'Enable Content Examination policy', description: 'In Mimecast: Administration > Gateway > Policies > Content Examination. Create a rule to hold/reject messages containing keywords like "bitcoin", "I recorded you", "I hacked". This catches sextortion that spam scores miss.', type: 'info' },
+        { label: 'Report to Mimecast threat intel', description: 'Forward the raw email as an attachment to abuse@mimecast.com to improve detection for all customers.', type: 'info' },
+        { label: 'Advise the recipient', description: 'Let the recipient know this is a scam. They should not respond, not pay, and delete the email. No credentials were actually compromised.', type: 'info' },
+      ],
+    };
+  }
+
+  if (subjectThreat === 'phishing') {
+    return {
+      headline: 'Suspected Phishing — Bypassed Spam Filter',
+      severity: 'high',
+      explanation: `The subject line matches known phishing patterns. Despite a spam score of ${score}, phishing emails frequently score 0 because they use legitimate sending infrastructure, contain no bulk-send signatures, and rely on social engineering rather than technical spam traits. The sender (${from}) should be verified before any action is taken on this email.`,
+      actions: [
+        { label: 'Block this sender', description: `Add "${from}" to Mimecast > Administration > Gateway > Policies > Blocked Senders.`, type: 'info', warning: true },
+        { label: 'Enable Impersonation Protection', description: 'In Mimecast: Administration > Gateway > Policies > Impersonation Protection. Enable checks for display name spoofing and lookalike domains.', type: 'info' },
+        { label: 'Enable Content Examination', description: 'Create a Mimecast Content Examination policy to hold messages matching phishing keyword patterns.', type: 'info' },
+        { label: 'Report to Mimecast', description: 'Forward the raw email as an attachment to abuse@mimecast.com.', type: 'info' },
+      ],
+    };
+  }
+
   if (score >= 10 || level === 'high') {
     return {
       headline: 'High Spam Score — Delivered',