Category Archives: Phishing Defense Center

SMILE – New PayPal Phish Has Victims Sending Them a Selfie

Posted on by

Phishing scams masquerading as PayPal are unfortunately commonplace. Most recently, the PhishMe Triage™ Managed Phishing Defense Center noticed a handful of campaigns using a new tactic for advanced PayPal credential phishing. The phishing website looks very authentic compared to off-the-shelf crimeware phishing kits, but also levels-up by asking for a photo of the victim holding their ID and credit card, presumably to create cryptocurrency accounts to launder money stolen from victims. Let’s examine the components of this phishing scam: The lure site is obviously hacked hxxps://hellopc[.]co[.]nz/ and the phishing kit is buried in a subdirectory presumably to thwart the anti-phishing…

The post SMILE – New PayPal Phish Has Victims Sending Them a Selfie appeared first on PhishMe.

SMILE – New PayPal Phish Has Victims Sending Them a Selfie was first posted on June 15, 2017 at 11:00 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading SMILE – New PayPal Phish Has Victims Sending Them a Selfie→

New Phishing Emails Deliver Malicious .ISO Files to Evade Detection

Posted on by

On May 22, 2017, PhishMe® received several emails with .ISO images as attachments via the Phishing Defense Center. ISO images are typically used as an archive format for the content of an optical disk and are often utilized as the installers for operating system. However, in this case, a threat actor leveraged this archive format as a means to deliver malware content to the recipients of their phishing email. Analysis of the attachments showed that this archive format was abused to deliver malicious AutoIT scripts hidden within a PE file that appears to be a Microsoft Office Document file, which…

The post New Phishing Emails Deliver Malicious .ISO Files to Evade Detection appeared first on PhishMe.

New Phishing Emails Deliver Malicious .ISO Files to Evade Detection was first posted on May 26, 2017 at 3:32 pm.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading New Phishing Emails Deliver Malicious .ISO Files to Evade Detection→

FBI Announces That BEC Scam Losses Continue to Skyrocket, as Losses Exceed $3.1B

Posted on by

Financial losses from business email compromise (BEC) scams skyrocketed by 2,370% between January 2015 and December 2016, according to an FBI public service announcement released Thursday. The alarming statistic represents a sharp increase from the agency’s previous announcement, serving as a warning to users to stay vigilant in recognizing the threat.   The new announcement refers to domestic and international losses (real and potential) totaling $5.3 billion. Previously, the FBI announced a $1,300% increase in losses, between January 2015 and May 2016, totaling $3.1 billion. This documented rise is a sobering reminder of the potential collateral damage that awaits users…

The post FBI Announces That BEC Scam Losses Continue to Skyrocket, as Losses Exceed $3.1B appeared first on PhishMe.

FBI Announces That BEC Scam Losses Continue to Skyrocket, as Losses Exceed $3.1B was first posted on May 19, 2017 at 9:00 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading FBI Announces That BEC Scam Losses Continue to Skyrocket, as Losses Exceed $3.1B→

Tales from the Trenches: DocuSign® DELoader Phishing Attack

Posted on by

Over the past several days, the Phishing Defense Center identified and responded to several messages related to an ongoing phishing email campaign spoofing DocuSign to carry out an attack. These messages appear to be official DocuSign emails including links to review the document. Upon clicking the link, various malicious files are downloaded to the victim’s computer including the DELoader financial crimes malware. The following details the indicators of the email messages and activity of the malicious payload. PhishMe® customers should note that these threat indicators have already been activated within PhishMe Intelligence™ and delivered to PhishMe Triage™ for identification and…

The post Tales from the Trenches: DocuSign® DELoader Phishing Attack appeared first on PhishMe.

Tales from the Trenches: DocuSign® DELoader Phishing Attack was first posted on May 17, 2017 at 11:05 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading Tales from the Trenches: DocuSign® DELoader Phishing Attack→

Google Doc – Mailinator Hits Hard

Posted on by

Mailinator Campaign Makes a Mark In the process of managing phishing threats for our customers, our Phishing Defense Center and PhishMe Intelligence teams saw a flood of suspicious emails with subject line stating that someone has “has shared a document on Google Docs with you”, which contained a link to “Open in Docs”. The “Open in Docs” link goes to one of several URLs all within the https://accounts.google.com website. Example of PhishMe Triage in Fig 1: Fig-1   Example of Mailinator Phishing Email in Fig 1-2: Fig. 1-2 “Open in Docs” hxxps://accounts.google.com/o/oauth2/auth?client_id=1024674817942-fstip2shineo1l sego38uvsg8n2d3421.apps.googleusercontent.com&scope=https%3A%2F%2Fmail.google.co m%2F+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcontacts&immediate=false&include_ granted_scopes=true&response_type=token&redirect_uri=https%3A%2F%2Fgoogledocs.g- docs.pro%2Fg.php&customparam=customparam The highlighted portion above can…

The post Google Doc – Mailinator Hits Hard appeared first on PhishMe.

Google Doc – Mailinator Hits Hard was first posted on May 3, 2017 at 6:10 pm.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading Google Doc – Mailinator Hits Hard→

April Sees Spikes in Geodo Botnet Trojan

Posted on by

Throughout April, our Phishing Defense Team observed an increase in malicious URLs that deliver the financial crimes and botnet trojan known as Geodo. These emails take a simple approach to social engineering, using just a sentence or two prompting the victim to click on a link to see a report or invoice that has been sent to them. An example of a typical phishing email used in these attacks is shown below: Following the malicious links will lead the victim to download a hostile JavaScript application or PDF document tasked with obtaining and executing Geodo malware. One common attribute of…

The post April Sees Spikes in Geodo Botnet Trojan appeared first on PhishMe.

April Sees Spikes in Geodo Botnet Trojan was first posted on May 2, 2017 at 3:35 pm.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading April Sees Spikes in Geodo Botnet Trojan→

Does your Incident Response Plan include Phishing?

Posted on by

It’s no secret that 90% of breaches start with a phishing attack. The question is: Are you prepared to recognize phishing and respond to it? Many organizations are concerned with how much spam they receive and implement controls specific to spam. But you shouldn’t confuse preventing spam with responding to phishing attacks. As our CTO Aaron Higbee points out in his recent post, “spam and phishing” are used “interchangeably” but are not the same thing.  To be adequately prepared to respond to phishing attacks, you must take the problem seriously and have a plan on how to respond. From the monetary loss that can…

The post Does your Incident Response Plan include Phishing? appeared first on PhishMe.

Does your Incident Response Plan include Phishing? was first posted on April 20, 2017 at 8:42 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading Does your Incident Response Plan include Phishing?→

Wide-Spread Ursnif Campaign Goes Live

Posted on by

On April 5th, our Phishing Defense Center received a flurry of emails with subject line following a pattern of Lastname, firstname. Attached to each email was a password-protected .docx Word document with an embedded OLE package. In all cases the attachments were password protected to decrease the likelihood of detection by automated analysis tools. A password was provided to the victim in the body of the email which attempts to lure the victim into opening the malicious attachment and to increase the apparent legitimacy of the message. An example of a phishing email for this attack is shown below: If…

The post Wide-Spread Ursnif Campaign Goes Live appeared first on PhishMe.

Wide-Spread Ursnif Campaign Goes Live was first posted on April 11, 2017 at 8:00 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading Wide-Spread Ursnif Campaign Goes Live→

W-2 Fraud – Tax Season and All Year Long

Posted on by

It’s the time of year when Taxes are on everyone’s mind – especially Phishers! The stress of filing.  The stress of gathering all the documents.  The stress of reporting.  The stress of the deadline.  All of that on top of everything else you have to do this time of year makes tax time phishing a favorite and highly successful annual event for phishing scams. However, once the filing is completed, it doesn’t mean the campaigns will stop.  W2 and CEO fraud are timeless phishing campaigns that run all year long. Whether aimed at individuals or businesses, tax time phishing scams…

The post W-2 Fraud – Tax Season and All Year Long appeared first on PhishMe.

W-2 Fraud – Tax Season and All Year Long was first posted on April 4, 2017 at 8:00 am.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading W-2 Fraud – Tax Season and All Year Long→

Tales from the Trenches:  Loki Bot Malware

Posted on by

On March 15, 2017, our Phishing Defense Center observed several emails with the subject line “Request for quotation” pretending to award Shell Oil Company contracts – a very targeted subject tailored to the receiver. As with most phishing emails, there is a compelling call to action for the receiver, in this case a contract award from a well-known organization. And, an added bonus unknown to the receiver, the emails also contained a malicious attachment designed to siphon data from its targets. Included is an example of one of these emails along with basic Triage header information. Each email analyzed contained instructions…

The post Tales from the Trenches:  Loki Bot Malware appeared first on PhishMe.

Tales from the Trenches:  Loki Bot Malware was first posted on March 23, 2017 at 4:09 pm.
©2017 “PhishMe Staging“. Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at pmit@phishme.com
Continue reading Tales from the Trenches:  Loki Bot Malware→