Skip to main content
Join us at Abnormal Innovate on November 5 in Dallas, TX

Jan 23, 2026

Weekly Abnormal Detection Enhancements

A weekly summary of detection enhancements delivered by the Abnormal engineering team.

Weekly Detection Enhancements - Weeks of December 19 - January 23

Week of December 19

  • Improved extraction logic for user-reported phishing emails to handle reported messages with unusual formatting.

  • Introduced new detection signals and heuristics that improve detection accuracy for malicious attachments.

Week of January 9

  • Implemented core attachment entity attributes and heuristics to support advanced threat analysis.

  • Improved recall for cold call and massmailer emails without unsubscribe links, improving detection of graymail.

  • Added detection for emails that pair Google Drive links with password phrases to block advanced phishing attacks.

  • Improved attachment analysis of Paypal and Norton scam attacks to stop image-based threats.

  • Added detection of new invoice fraud attacks leveraging Docusign.

Week of January 16

  • Enabled RSA intelligence scoring of email attachments to improve detection of hidden threats.

  • Added new capabilities that strengthen detection of brand impersonation attempts within email attachments.

  • Added attachment analysis to email classification, improving the accuracy of classification decisions.

  • Added detection to stop attacks delivering malicious HEIF and DOCX attachments from email hosting senders.

Week of January 23

  • Added detection to identify suspicious calendar invites with abnormal durations, reducing risk of calendar-based attacks.

  • Updated detection logic in AI Security Mailbox, improving accuracy and reporting for phishing simulations.

Protect Against Evolving Email Threats

See how behavioral AI detects attacks that legacy defenses miss.