Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Signal workspace
Reply-guy support account intercepts complaint threads.
Account monitors public complaints about the brand and offers to resolve each one over direct message, away from any channel the support team can see.
Observed content
Sorry about the delay on this one. Our team can release the hold right now. Send us the card number, the expiry date, and the phone number registered to the account by direct message, and we will have the funds back with you in a few minutes. No need to call support.
Why we flagged it
Handle differs from the official account by one underscore, replies exclusively to brand complaints, and requests card credentials in direct messages.
82
severity
- Relevance
- 95%
- First seen
- 4 hr ago
- Check version
- sentinel-threat-v1
Signs of harm
credential-requestofficial-insignia
Evidence
Each capture is hashed on write. The digest is what makes the record checkable later.
- Screenshotcrawl4ai-screenshot226 KB · 12 Mar 2026, 10:22 UTC
sha256
1dbffedd4b170d79eaa0dcc0d17932f03fb82007fb9e78676d86bf5bccc4c836 - Listing metadataofficial-api7 KB · 12 Mar 2026, 10:22 UTC
sha256
8440a6f97f248e85d5c5fe581858caa75d1717d941efb36f272e3b5885909688
Decision trail
Append-only. Every status change records who and why.
- detectedHandle matched the impersonation pattern for the official support account.Collector · System · 4 hr
- detecteddocumentedReply thread and profile record captured.Priya Raghunathan · Analyst · 4 hr
- documentedconfirmedCredential request reproduced across four separate complaint threads.Priya Raghunathan · Analyst · 4 hr
- confirmedescalatedReported to the platform under the impersonation policy. The credential request reproduced across four separate complaint threads, so reach is documented rather than asserted.Daniel Osei · Officer · 4 hr