To Customer Support To Customer Support

Events
Leaderboard
Customer Support

Home
Community overview
Threat Intel Hub
Phish Tank

Phish Tank

Stay up-to-date on the latest phishing threats and learn how to prepare for them

24 Topics
12 Replies

When you subscribe we will email you when there is a new topic in this category

New Customized Attacks Leverage HR Theme and QR Codes

ChatGPT Subscription Renewal Phishing Emails Target Credit Card Data

XWorm Malware Targeting CPA Firms During Tax Season

24 Topics

Most replies

Most views

Newest first

TroyGIllCommunity Manager

published in Phish Tank

New Customized Attacks Leverage HR Theme and QR Codes

QR code phishing has ramped back up after tapering off during the final weeks of 2024. QR code attacks have been popular over the last several years as they help attackers to avoid business security solutions and switch targets from protected environments to their own personal devices, where security controls may be lacking. However, some recent attacks went the extra mile to add personalization to their attacks in the hopes of tricking the recipient into believing the message was a valid internal communication from their own HR team.These attackers are constantly innovating, and, in this campaign, they went as far as to scrape recipients profile pictures from LinkedIn and inserted them into the message and the attached PDF to lend credibility to the attack. This campaign utilizes an employee benefits theme which is common in QR code phishing attacks and spoofs “Admin HR” and the recipient’s domain in the filename. To further entice the user the message promises a bonus distribution ha

8 days ago

TroyGIllCommunity Manager

published in Phish Tank

ChatGPT Subscription Renewal Phishing Emails Target Credit Card Data

Threat actors have been using LLM’s to create more convincing phishing attacks for some time now. We have now observed them using ChatGPT Subscription renewals as their phishing lure to entice users of the LLM to disclose their credit card data. The example below stated their subscription would expire soon and urged the recipient to click a button to renew. However, upon closer inspection we can see that the URL leads to an unrelated [.]info TLD instead of the legitimate ChatGPT site.This attack was going directly after credit card information with a reasonable request for less than USD $25. Once disclosed the victims credit card would be used to make fraudulent online purchases at online retailers. These fraudulent purchases are sometimes accompanied by a DSD attack to conceal the activity from the victim. Remember, if you suspect a subscription is due for renewal always navigate directly to that site to submit payment instead of following links within an email.

150

11 days ago

TroyGIllCommunity Manager

published in Phish Tank

XWorm Malware Targeting CPA Firms During Tax Season

As tax filing deadlines approach, we always see an increase of tax-themed attacks and this year is no exception. Everyone should be on guard as attacks posing as IRS notifications and tax preparation companies are prevalent. However, it is also important to remember that the tax preparers themselves are at a heightened risk. The potential troves of sensitive data which could be exposed through a malware breach on a CPA or Tax Service network makes for an extremely attractive target for malicious actors. And given the nature of what they do with taking on unknown clients and receiving financial documents they must remain extremely vigilant.One threat group we have observed targeting CPA firms in recent years past we again recently spotted using similar tactics as in recent years to infect targets with a remote access trojan. This example purports to be tax documents attached and contains a link to a zip file download.If the user downloads and extracts the ZIP archive, they will see two

100

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Malware Alert: Targeted Attacks Determined to Infect Specific Users

We recently discovered a highly targeted malware attack only sent to only a handful of customers who possibly have personal connections to Ukraine. The attacks focused on select users at three separate organizations, an election company that serves both businesses and governments along with two other organizations dealing with influential public advertising and marketing. Over the course of three days, we saw the same threat actor attempting to infect the same specific users using separate and distinct malware families.The first attack purports to be from the Central Office of the Security Service (SBU) of Ukraine. The theme was around an investigation into the legalization of income and soliciting information from the recipient contained within the [.]ZIP attachment. In both attacks, they utilized bitbucket as its command and control (C2) communication to deploy payloads. It also utilizes the same C2 IP (185[.]70[.] 104[.]90) which resolves to hostkey[.]ru in Moscow.If the [.]ZIP is e

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Credit Card Details Still in Many Attackers Crosshairs

Phishing threats have evolved over the years as threat actors have found more inventive ways to raise the stakes from a financial perspective. For example, revenue from BEC’s and Ransomware is estimated well into the Billions (USD) on an annual basis, netting threat actors’ massive profits. Despite this, we do still see attacks aimed an PII and credit card details to be leveraged in fraudulent transactions.One of these recent attacks leveraged a Netflix theme, stating the recipient’s account has been placed on hold until their payment details are updated. The message urged the user to update their payment details by clicking on a link within the message. Following the link leads to the attacker-controlled and realistically named domain (processingsolution24[.]com) for credit card “processing”. However, this domain has been registered by the threat actor and is not related to legitimate Netflix billing. If the user enters their card details, it would be posted to a PHP page at otl[.]su.

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Brand Cohesion in Multiple Layers of Microsoft Bookings Attacks

Microsoft remains the most spoofed brand in phishing attacks in the new year. The number of variations of theme within the Microsoft brand is quite extensive. To put it plainly, if it is a Microsoft business/consumer service, mostly likely we have seen a multitude of phishing attacks invoking it to dupe users into falling victim.A recent attack added a rare new twist by invoking the Microsoft Bookings (Scheduling tool) to instill a sense of legitimacy in the mind of the recipients. It purported to be an “Encrypted EFT Invoice Payment” with a link to the invoice, which the user would need to click on to retrieve. The link leverages ncv.microsoft[.]com, Microsoft Dynamics customizable survey offering that is abused heavily by threat actors for attacks like these. Through abuse of this Microsoft service the actors obscure the malicious nature of the URL as a Microsoft domain would not arouse suspicion for most everyone taking the time to look. Utilizing Dynamics also servers to keep the b

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Holiday Shoppers Beware: Shipping Notification Lures Abound

Holiday shopping is in full swing and for many people, that means their inboxes are inundated with shipping notifications. Attackers utilize shipping themed attack vectors year-round but never so often as during the holiday season. These are effective lures for threat actors to either deliver malware or harvest credentials from unsuspecting users.One very convincing shipping themed phishing variant observed recently stood out as it was particularly well crafted. This attack would easily pass they eye test given the convincing wording and visuals of both the email, as well as the phishing page.As we have seen quite frequently in a variety of phishing attacks over the past several months, ipfs[.]com is being leveraged to host this DHL branded credential harvesting page.This example happened to be DHL themed, but these are frequently observed posing as USPS, UPS, FedEx etc. And not only is this a very popular social engineering tactic in credential harvesting attacks but also with malwar

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Image-based Phishing gaining popularity

Image-based phishing has been prevalent for years, but it has exploded in recent months, especially with the advent of Quishing (the unattractive term recently coined for QR code phishing). In these attacks the entire email body text is contained within the image itself, while the image also serves as a link to a malicious/phishing website. It also follows another popular trend we have recently observed in that it abuses Cloudflare’s CAPTCHA service to deter automated analysis. The image used in the following attack borrows some assets from legitimate Microsoft emails and induces a sense of urgency in the user claiming that their password expires today. The image link leverages Baidu[.]com which is often referred to as the “Google of China”. We have noticed a significant increase in phishing attacks leveraging this service for re-directs as it is typically viewed as benign in nature.Clicking on the image first directs to this Cloudflare captcha page where the verification box just nee

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

YPO Phishing Attack Leaves Data Exposed

Threat actors continually search for novel social engineering tactics to avoid arousing suspicion and to disguise their payloads. Sometimes they fail to take the necessary action required to conceal their activity. A recent attack we quarantined was posing as a message regarding joining a YPO Global Leadership Committee. It stated, “a comprehensive Dossier that delves deeper into what being a part of this esteemed committee means,” was attached (via HTML) to the message.When opening the html attachment, you are presented with a Microsoft OWA themed login portal in your default browser.Upon further analysis to determine where the attackers were posting the stolen credentials, we discovered an open directory on the site which showed the compromised data of previous victims who were not using our email threat protection. This open directory, of course, leaves the compromised data open to anyone who goes to look and not just the threat actor. Also contained in the directory was the attack

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

While Cryptocurrency Adoption Grows: So Does Attack Surface

With over 420 million investors worldwide and expanding every day, cryptocurrency ownership is a widening attack surface. What is more, with many casual investors into the cryptocurrency market many newly minted owners may find themselves in an unfamiliar territory given that they may be new to the platform, exchanges and general process surrounding cryptocurrency which can help play into the hands of attackers.We continue to capture many unique cryptocurrency attacks targeting customer wallets. One of the latest versions was masquerading as a legal claim resolution for held crypto funds regarding the Voyager platform bankruptcy. Voyager filed for bankruptcy back in August of 2022 after citing volatility in Crypto markets and default of a loan made to Three Arrows Capital. This news left platform users reeling while scrambling to discover if their funds would be recovered and that process would drag on for many months with much uncertainty. Threat actors would, naturally, never let a g

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Customized Attacks Leverage Facebook and IPFS

Threat actors have long used social media content for both reconnaissance and as a data source to customize phishing attacks to enhance credibility. This example was attempting to masquerade as a Voice2eMail message. However, each message comes customized to the target organization as the inserted image in the email changes depending on the company being targeted. The attacker-generated emails pull the image from the target companies Facebook profile and insert it into the custom-branded message. This is done to try to convince the user this message originated from their own voicemail system, and this makes for a very compelling attack.If the company did not have a Facebook presence or photo, a generic Microsoft image is inserted. To disguise the true nature of the URL, these attacks abused LinkedIn’s “slinks,” a feature that businesses can use in their LinkedIn profile for tracking marketing and ad campaign metrics. This LinkedIn service will serve as a redirect to a second destinatio

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Human Resource Emails Deliver Modular Phishing Pages

A clever social engineering approach we often see involves attacker crafting emails that pose as internal HR communications. This “employee performance report” campaign purporting to be the recipients own HR department also contained multiple payloads which is becoming increasingly popular. These attackers are using a look-a-like domain of intended recipient. The email lures its target by claiming to include a list of employees that are being promoted in the performance report, this is a clever tactic to entice users into interacting with the link or attached file.However, cleverer than the tactic used in the email lure is the functionality of the phishing site delivered in the payload URL. Cloudflare’s R2 cloud storage service is being leveraged by these threat actors to host a modular credential harvesting page that is customized depending on the target domain. For demonstration purposes, we manually added test@microsoft.com to the end of the payload link to show the site pulling the

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Spoofed Microsoft Teams Invites are Popular Lure

Unquestionably one of the most spoofed brands, in email attacks, over the past several years has been Microsoft. Recently, threat actors have continued with some clever spoofed Microsoft Teams emails. One of the most popular variations of MS Teams attacks mimic the legitimate emails sent when a user is added to a Teams group. This example originated in Hungary from the domain godmanmedicals[.]store. Generic tld’s, such as [.]store, are commonly abused at times when hosting companies conduct yearly registration deals to promote a specific gtld. This domain was registered thru Namecheap who currently offers the first year for [.]store tld’s at .98 (USD), threat actors love a bargain as much as anyone.The payload link leads to a phishing portal that mimics the MS 365 OWA login portal design. However, this actor removed all the Microsoft branding and favicon with the likely goal of avoiding security product detections and keep the page active for a longer duration.In addition to removing t

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Formbook(Xloader) Malware Distribution Snapshot

Fraudulent purchase orders and shipping notifications have been two common recurring themes for distributors of multiple different malware families. This malicious attack, shown below, presented itself as a shipment status notification from TNT Express. TNT is a shipping and logistics company operating in more than two hundred countries and was acquired by FedEx in 2016 but still retains the TNT branding outside the US. It stated shipment paperwork was attached but was a disguised [.]gz file presenting itself as a PDF. Double extensions such as this combination should always be a big red flag. Upon extracting the gzip archive an executable was inside that turned out to be XLoader. XLoader is a stealthy rebranded version of Formbook(info-stealer) offered in licensed subscriptions via the malware-as-a service model. It is cross-platform capable of infecting both Windows and macOS.Below is an underground forum XLoader ad, published by bleepingcomputer in 2021, when it started to become no

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Meta Ad Violation Leads to Credential Theft

Marketing on Meta-owned platforms have become part and parcel for many organizations. Threat actors are keenly aware of this and often craft phishing attacks looking to capitalize on this fact. Our analysts frequently run across phishing emails attempting to leverage Meta ads in one way or another.Recently, an interesting Meta ad violation campaign targeted many users claiming that their ad accounts had been temporarily disabled with the goal of stealing their Meta credentials.The “SUBMIT” link leads to a Meta branded page, hosted on Google’s web[.]app domain, which includes a captcha checkbox and Meta branding.Continuing to the next page includes a fictitious report number and requires some basic information to begin the rebuttal process on this ad violation and collects basic personal information. After agreeing to the terms with the checkbox on and clicking “Submit” a password prompt is displayed. By design the page will always state an incorrect password was entered to farm all pos

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

QR Code Phishing- A Natural Evolution

The use of QR codes has been one of the many methods threat actors have deployed recently in an effort to circumvent security controls. QR codes have become so common place, like being used for paperless menus at restaurants, that everyone has grown quite accustomed to reaching for their mobile device at the first sight of one. Attackers are aware of this and by utilizing QR codes in email, attackers hope to avoid business security solutions and switch targets from protected environments to their own personal devices, where security controls may be lacking.This example acted as a Microsoft MFA one time passcode authentication/expiration message that the recipient would need to scan to keep their current password, however, most legitimate services would never offer a user to keep their current password if it was indeed expiring. Upon decoding the QR code, we see that it points to a customized subdomain on web[.]core[.]windows[.]net, Microsoft Azure’s blob storage site.If a user proceeds

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Service Abuse Provides Cohesive Phishing Threats

Many phishing attacks rely heavily on service abuse as threat actors continue to leverage LotL Phishing attacks to their advantage in the hopes of not raising red flags for their targets but they do not always have such brand cohesion as the example we will look at below.This email originated from a compromised nhs[.]net Microsoft account, the email system for National Health Service employees in England & Scotland. The theme was a Microsoft “secure fax pdf” originating from the “ShareFile Team 2023.”The payload URL linked to customervoice[.]microsoft[.]com, the legitimate Dynamics 365 service for gathering customer feedback via surveys. We have captured quite a few phishing attacks leveraging this service since last year and this one was a splendid example of a cohesive branding strategy (Microsoft- sender, graphics, link, and phishing portal) leveraged in an attack. While this tactic hopes to serve as a disguise to the disposition of the URL but one can easily see how it would a

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Think Twice Before Clicking Those LinkedIn Notifications

LinkedIn phishing continues to remain a favorite attack vector by threat actors. Sales solicitations are seen in such abundance on the LinkedIn platform that many users may be in the habit of clicking these notifications poste-haste while weeding out the noise.This example claimed to be a message reminder for “2 new messages” from salesperson for Janssen Pharmaceuticals, a Johnson & Johnson company. However, the from address displayed the domain of 51job[.]com, a recruitment website in China with the message originating from servers located in Moldova. The payload link leads to a generic phishing kit located at youdontcare[.]com. It will pre-fill the recipients email address and domain name into the site based upon a string in the URL, we used someone@somewhere.com for the image example below for illustrative purposes.

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Sophistication in Phishing Attacks on the Rise

Threat actors commonly utilize compromised accounts in concert with a mix and match of different strategies to disguise their attacks. The layers of complexity and customization is often beyond the scope of what you might think of as a “typical” phishing attack, but these are more common than you might think. Threat actors often incorporate several layers of obfuscation and personalization while also sending these attacks from a legitimate and trusted source.A recent example, though emanating from a compromised user account, had a fraudulent “SharePoint secure message.” However, the encrypted message theme used the Proofpoint encrypted email format and corresponding email lock image. The payload link directed to a file uploaded to and hosted on the Adobe Acrobat cloud site to give an added appearance of authenticity and to mask the disposition of the URL.If the link is followed, the target will view the uploaded pdf which also shares the SharePoint theme and asks for the user to click

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Qakbot Disrupted: But for How Long?

It is always encouraging to see a WIN for the for the white hats. On August 29, 2023 the US Department of Justice announced the success of a multinational operation to disrupt the malware and botnet activity associated with Qakbot. While remote access trojans continue to be the highest volume of malware attacks we capture, Qakbot/Qbot has been one of the most destructive and convincing email attacks we see targeting users. Let us take a look at two examples of recent activity which highlights their tactics. Qakbot/Qbot affiliates were observed just prior to takedown sending campaigns in response to previously stolen emails with a pdf attached. Replying to scraped conversations or conversation hijacking (CHA) was a favorite technique seen with Qakbot distribution. The affiliate in this example uses the tag (identifier) of BB28 and has geofenced infections to just the United States. The pdf attachment links to a zip file containing an executable ([.]exe) & dynamic link library ([.]dl

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Attacks Seek Financial Data Using PCI Lure

Phishing attacks operating under the guise of security or compliance notifications are old hat for threat actors. Mostly because it has been a tactic that piques interest on behalf of the recipient and has brought them some success in the past. This recent attack looked to exploit trust and adherence to PCI compliance. As most businesses that accept credit and debit card payments know, the payment card industry data security standards (PCI DSS) council creates the standards for security of the industry. A threat actor recently was purporting to be the risk department for PCI DSS. They stated that an attached “Know Your Customer” verification PDF file would need to be completed and returned to an address at pcidss[.]cc. However, this is an address under the actors’ control and not the official PCI DSS domain or any address associated with the legitimate standards council.Viewing the attached pdf, we see the attacker was after the business and financial information of the recipients. The

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Email Bombs Disguise Fraud - Distributed Spam Distraction (DSD)

Email bombs are a type of Denial of Service (DoS) attack. Victims face an uncontrollable deluge of messages quickly filling up their inbox when the attack begins. With volume in the thousands, the attack renders the victims mailbox useless. Victims struggle to make sense why a sudden avalanche of messages are filling up their inbox, however, this is no accident. Motives for the attack vary but the vast majority we see are to perpetrate some type of fraudulent activity with the victims compromised information. The bomb is typically designed to distract the user from emails generated due to fraudulent purchases , financial account updates or transactions. During these type of attacks, we've observed fraudulent airline ticket purchases, Apple store orders, and many Best Buy pickup orders. If applicable to the fraudulent purchase - such as a Best Buy pickup order, attackers have mules ready to quickly pick up the fraudulently purchased merchandise soon after the attack begins.If you or so

21 days ago

TroyGIllCommunity Manager

published in Phish Tank

Coronavirus Fears Exploited in Phishing Attacks

Over the past few weeks, we have been patiently awaiting a surge in malicious email activity surrounding the Novel Coronavirus outbreak that has garnered headlines across the globe. We had previously spotted some run-of-the-mill spam campaigns that were leveraging the outbreak to hawk over-ear facemasks. We subsequently saw some activity from the Emotet malware group that was exploiting the topic by sending mal-spam links. However, those were limited in scale and seemed to be only targeting users in Japan.Today, we began monitoring a phishing campaign that poses as an alert from the CDC and appears to have wider distribution. The email, which is made to appear from the Centers for Disease Control and Prevention, claims to provide a list of Novel Corona cases “around your city” and advise that the recipient go through the cases to avoid exposure to the virus. However, the links in the message lead to a phony OWA login page designed to harvest email credentials.Here’s a look at the messa

21 days ago

TripleHelixModerator

posted in Phish Tank

Microsoft July 2024 Security Updates (Patch Tuesday)

July 2024 Security UpdatesThis release consists of the following 139 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?SQL Server CVE-2024-20701SQL Server CVE-2024-21303SQL Server CVE-2024-21308SQL Server CVE-2024-21317SQL Server CVE-2024-21331SQL Server CVE-2024-21332SQL Server CVE-2024-21333SQL Server CVE-2024-21335SQL Server CVE-2024-21373SQL Server CVE-2024-21398SQL Server CVE-2024-21414SQL Server CVE-2024-21415Windows CoreMessaging CVE-2024-21417SQL Server CVE-2024-21425SQL Server CVE-2024-21428SQL Server CVE-2024-21449Windows Secure Boot CVE-2024-26184Windows Secure Boot CVE-2024-28899SQL Server CVE-2024-28928Windows MultiPoint Services CVE-2024-30013Microsoft Dynamics CVE-2024-30061Windows Remote Access Connection Manager CVE-2024-30071Windows Remote Access Connection Manager CVE-2024-30079Windows NTLM CVE-2024-30081Windows Cryptographic Services CVE-2024-30098.NET and Visual Studio CVE-2024-30105Microsoft Office SharePoint CVE-2024-3298

8312

5 months ago

Badges

pierrequiroulehas earned the badge Beta To The Max
Daves Big Machas earned the badge Bear Bell (Tech Talk Badge)
russell.harrishas earned the badge Product Help: Posted 50 comments!
JAQ-PChas earned the badge Beta To The Max
tmcmullenhas earned the badge News: Posted 50 comments!

Show all badges

Join the Conversation

Tweets by Webroot

Terms & Conditions

Sign up

Already have an account? Login

Username *

E-mail address *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

Cybersecurity Solutions OpenText Cybersecurity 2024 Threat Report Cyber Resilience Program

LinkedIn Twitter YouTube