Generic email credentials phishing _{^(2022-06-02)}

Overview

The threat actor leverages a fake PDF document download theme, to acquire email login credentials.

Explanation

In this phishing attempt, the threat actor sends an email saying that a PDF file is available to be downloaded. The phishing link (hxxps://sfo3[.]digitaloceanspaces[.]com/omdshudhuw0dgw201sei0/%21%24.o.m.%26%26%21/%21%26%21.om.d.%26%24%21.html#example@gmail.com>) makes use of the recipient email address to fill the phishing form.

The phishing page detects the domain of the recipient’s email address, and adapts the logo accordingly on the left top-corner. For demonstration purposes, we used gmail.com.

A fake Symantec verification (yellow logo) is also shown to easier acquire the trust of a potential victim. No actual PDF file is available to be downloaded and the threat is limited to phishing only.

Example

---

Prevention

If you are uncertain about the authenticity of an email, do not hesitate to contact the entity that seems to have sent you the email using a safe communication manner, using the phone for example (no phone number from the untrusted email must be used in order to verify the authenticity).
If you are working for the Luxembourgish government or are using any of the GOVCERT.LU services, it is important to forward phishing emails to us (using Reporting an incident or the Outlook button). This will allow us to take down phishing websites and protect members of our constituency.