
Summary
This rule detects inbound messages that contain links to Apple App Store pages impersonating popular AI services (OpenAI, ChatGPT, Meta, Gemini) and that are presented as free advertising or management tools. It triggers when a link to apps.apple.com is found in the message body, then analyzes the linked web page by locating a JSON-LD script tag with id="software-application" and type="application/ld+json". The JSON is parsed to extract the app’s name. If the name contains AI-service indicators (openai, openal, open ai, open al, chatgpt, meta, gemini) and also contains terms suggesting advertising/management functionality (suite, ads, advert, manager, campaigns), and the offers.category equals "free", the rule flags the item as suspicious. Detection methods include content analysis, URL analysis, and HTML analysis, with a focus on brand impersonation related to AI services and potential credential phishing vectors stemming from misleading App Store listings.
Categories
- Web
Data Sources
- Script
Created: 2026-03-05