August 9, 2024
This email is designed to impersonate the recipient's email service provider, attempting
to create a sense of urgency by notifying the user of unusual sign-in activity
on their account. The message is crafted to look legitimate, using the service
provider’s branding and language to convince the recipient that their account
security is at risk:
The goal is to prompt the recipient to take immediate action, leading them to click on the malicious links that points to a credential harvesting website.
The email pretends to be a request for a quote, asking the user to check the details.
However, its real goal is to trick the recipient into opening the attached file,
which contains a harmful executable. If the recipient runs the file, it infects
their system with the Formbook stealer, all while they believe they're handling
a normal business request:
The threat actor's primary objective is to manipulate the victim into executing
the payload, thereby infecting their system with infostealer malware. This enables
the attacker to secretly harvest sensitive information and credentials, compromising
the victim's security.
In this phishing email, the attacker impersonates the HR department of the recipient's company. The message looks very genuine and the language use is realistic, but the actual content is very suspicious. The link embedded in the email leads to a credential harvesting website, which reveals this to be a malicious email.
This is a compelling example of a typical phishing email leveraging sextortion to extort money from the recipient. The attacker falsely claims to possess explicit material involving the recipient and demands payment in Bitcoin, threatening to release the alleged content if their demands are not met.
| TYPE | IOC |
|---|---|
| URL | hxxps[://]bafkreiceueo7767gj3gmx56zfp2ipy5vqrgogjv4n77fvrigtjlxtfhmjq[.]ipfs[.]dweb[.]link/ |
| FILE | be8d974d3e262ea959427e8964cbf4ec315d9ad11554e64b4aae8aa5ef34ff1b |
| FILE | de796036f54fe704ce2e91545fa22343fbca274f5838e056416d0cdeb51e4e3e |
Threat insights is a weekly series were we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!
