<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Callback Phishing

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js detect --email <file>` | Detect callback phishing indicators |
| `node agent.js extract-numbers --email <file>` | Extract phone numbers from email |
| `node agent.js analyze-number --number <number>` | Analyze phone number type and risk |
| `node agent.js check-number --number <num> --database <file>` | Check against TOAD database |
| `node agent.js batch-scan --mailbox-export <dir> --output <file>` | Batch scan mailbox |
| `node agent.js generate-edr-query --tool <anydesk\|teamviewer>` | Generate RAT detection query |
| `node agent.js generate-sigma --detection-type rat-install` | Generate Sigma rule |
| `node agent.js incident-report --email <file> --numbers <nums> --affected-users <users>` | Generate report |
| `node agent.js block-numbers --number-file <file>` | Generate block list |

### Examples

```bash
# Detect callback phishing in suspicious email
node agent.js detect --email /tmp/suspect.eml

# Extract and analyze phone numbers
node agent.js extract-numbers --email /tmp/suspect.eml
node agent.js analyze-number --number "+18005551234"

# Generate EDR query for AnyDesk installation detection
node agent.js generate-edr-query --tool anydesk

# Generate incident report
node agent.js incident-report --email /tmp/suspect.eml \
  --numbers "+18005551234" --affected-users "user@company.com"
```

## TOAD Campaign Indicators

| Pretext | Brand Impersonated | Typical Amount |
|---|---|---|
| Subscription renewal | Geek Squad, Norton, McAfee | $299-$499 |
| Payment confirmation | PayPal, Amazon | $150-$1000 |
| Invoice | QuickBooks, Xero | $500-$5000 |
| Account suspension | Microsoft, Apple | N/A |
