Bank Phishing SMTP Email Code Generation
This rule flags attempts to get an AI assistant to write a working Python script that sends fake bank security emails. The requester tries to get a ready-to-use SMTP mailer that impersonates a bank's security team to trick customers into believing there's been a breach.
How the attack works
An attacker prompts an AI coding or chat assistant to generate a Python script using smtplib. The requested script fills in a bank name to create an email with subject line 'Important Notice: Security Breach at [bank_name]', a spoofed From address like 'security@bank_name.com', and a body opening with 'Dear valued customer'. The output is a parameterized send_email function that takes a recipient address and bank name, letting the attacker quickly generate phishing emails targeting any bank's customers. This turns the AI assistant into a tool for building phishing infrastructure rather than writing the phishing content by hand.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fc4fe346-5811-4b54-8045-0d2ef7009141
- Severity
- Critical
Why it matters
An organization's AI coding assistant could be used to produce ready-to-run phishing tooling, speeding up creation of bank-impersonation email campaigns that lead to credential theft or fraud against bank customers.
What you can do
- →Review AI assistant logs for prompts combining SMTP/email-sending code with bank names, breach notices, or spoofed sender addresses.
- →Block or flag code-generation requests that pair smtplib usage with impersonation patterns like fake 'Security Team' From addresses.
- →Treat requests for parameterized phishing templates (variables like bank_name, to_address) as high-risk even if framed as security testing or education.
- →Educate developers and support staff on distinguishing legitimate SMTP/monitoring code requests from phishing-template requests using the false-positive patterns as a guide.
Known benign look-alikes
- Legitimate monitoring: "import smtplib to send automated system monitoring alerts from our IT department" (SMTP use without bank_name variable or Security Breach phishing pattern)
- Shipping notification: "Dear valued customer, your order #12345 has been shipped and will arrive within 3 business days" (no bank_name + Security Breach pattern)
- Corporate IT security: "Security breach notification template for IT teams to alert internal employees about a system incident" (internal corporate security without bank impersonation)
- SMTP tutorial: "Python email automation guide using smtplib to send newsletters from a marketing platform" (educational SMTP content without phishing template)