Inspect iCalendar (.ics) X-ALT-DESC HTML content for phishing payloads
We experienced a targeted phishing campaign where the entire payload — branded impersonation, QR code, credential harvesting links — was embedded in the X-ALT-DESC HTML field of an .ics calendar attachment. The email body was empty. Inky classified it PCL:4 and delivered to inbox. EOP independently scored the same campaign SCL:9 for a different recipient whose copy bypassed Inky routing.
Three requests:
Parse .ics X-ALT-DESC HTML with the same depth as email body content — link extraction, brand impersonation, computer vision, AI analysis
Flag suspicious .ics structure — the attachment was padded with dozens of bogus X-headers containing random hex strings, a clear obfuscation pattern
Explore a fallback model for EOP verdicts — currently re-injection sets SCL:-1 unconditionally, which overrode EOP's SCL:9 quarantine decision. When Inky misses, there's no safety net.
Inky support confirmed the .ics gap and the SCL override behavior is by design. Submitted as a feature request per their recommendation.
Log in to comment and vote
Comments4
Matt Sywulak
Apr 6
Hey @Joel Stigliano, I appreciate you making this request - we typically don’t want to publish techniques that could or couldn’t be used against INKY so I’m going to leave this one private for now. Do you have a link the example email in question that caused you to put this request in?
On the admin dashboard if you find the message the best way to link it would be to copy the url using this option.
Joel Stigliano
Apr 7
Hey @Matt Sywulak, thanks for the response. I can certainly appreciate not wanting to publish this to the board. I’m just glad to have someone over there check my math. :)
https://app.inkyphishfence.com/observation?feedbackId=c3Vuc2hpbmUtY29tbXVuaXR5LWhlYWx0aC1jZW50ZXIvZGF6aW1pLXRhYnJpemlAc3Vuc2hpbmVjbGluaWMub3JnL2UyMjYyMWE0YTU2MTlhMDUxYWM4MDk4MTc4NTZhM2YyLzE3NzM5MzI3MTMuODQwOTU0Mw==&isOutbound=false
Matt Sywulak
Apr 8
@Joel Stigliano Any chance you have the raw copy of the email you can zip up and send to me at matt@inky.com or through a share link? We couldn’t find a raw copy of this one or a similar one that’s close enough to use for back testing. We’re adding the detection that we need but it would be good to validate against a live example.
Joel Stigliano
Apr 11
@Matt Sywulak sending your way now. Sorry for the delay. We’re a small shop in nowhere Alaska. :)