November 1, 2024
This email pretends to be from WeTransfer, claiming the recipient has received files related to a “New Order Enquiry.” The email is filled with subtle typos, which may give some users a hunch that it's fake, but the familiar WeTransfer logo and layout make it look credible at first glance.
If the user clicks the link, they’re directed to a website designed to look like a WeTransfer download page, complete with a fake login form. Anyone who enters their credentials here unknowingly sends their login details directly to the attacker.
This email arrives under the guise of an HR payroll schedule for October, supposedly shared via OneDrive. The email looks official, but when the recipient clicks the link, they’re taken to a poorly designed webpage claiming to host the payroll document.
To access it, users are prompted to “unlock” the document by entering their login information. Instead of revealing any schedule, this site simply collects the entered credentials, compromising the victim’s security.
This phishing email takes advantage of recent KYC (Know Your Customer) policies for cryptocurrency platforms. It poses as a MetaMask notification, warning that the recipient’s account will be suspended within 48 hours if verification isn’t completed. The sense of urgency in the email often prompts quick action, leading victims to a fake MetaMask page.
Here, they’re asked to enter their recovery phrases, which are then immediately captured by the attackers, giving them full access to the wallet and any assets within.
| TYPE | IOC |
|---|---|
| URL | hxxps[://]ipfs[.]io/ipfs/QmQMPh4PpbCGJEVTmjv47d21ApFSHSZnK4pEL46womAJC5/update-we%20image[.]htm |
| URL | hxxps[://]ipfs[.]io/ipfs/QmbgJuiJ5Hb8FEeVgZxmzSymwb8T2zVCCJWyB61kCfxswC/octoberdoc[.]html |
| URL | hxxps[://]seomni[.]com/mt |
| URL | hxxps[://]smartcaptchapro[.]com/ |
| URL | hxxps[://]smartcaptchapro[.]com/import/home |
Threat Insights is a weekly series where we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!
