Threat insights 0x21: Formbook stealer

Unusual sign-in activity

This email is designed to impersonate the recipient's email service provider, attempting to create a sense of urgency by notifying the user of unusual sign-in activity on their account. The message is crafted to look legitimate, using the service provider’s branding and language to convince the recipient that their account security is at risk:

The goal is to prompt the recipient to take immediate action, leading them to click on the malicious links that points to a credential harvesting website.

Fake request for quote

The email pretends to be a request for a quote, asking the user to check the details. However, its real goal is to trick the recipient into opening the attached file, which contains a harmful executable. If the recipient runs the file, it infects their system with the Formbook stealer, all while they believe they're handling a normal business request: The threat actor's primary objective is to manipulate the victim into executing the payload, thereby infecting their system with infostealer malware. This enables the attacker to secretly harvest sensitive information and credentials, compromising the victim's security.

Annual compliance leave report

In this phishing email, the attacker impersonates the HR department of the recipient's company. The message looks very genuine and the language use is realistic, but the actual content is very suspicious. The link embedded in the email leads to a credential harvesting website, which reveals this to be a malicious email.

Bitcoin sextortion

This is a compelling example of a typical phishing email leveraging sextortion to extort money from the recipient. The attacker falsely claims to possess explicit material involving the recipient and demands payment in Bitcoin, threatening to release the alleged content if their demands are not met.

IOCs

Keep up with threat insights

Threat insights is a weekly series were we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!

Get more insights like this