URGENT Sales confirmation _{^(2022-08-02)}

Overview

The threat actor leverages an HTML file, attached in the e-mail, to acquire the password of the recipient’s e-mail address.

Explanation

In this phishing attempt, the threat actor uses an HTML file, instead of using a fake web page. Such files are usually opened by a browser or directly by an e-mail client. HTML phishing files are similar to fake phishing web pages.

In this case, the e-mail client displayed the content of the HTML attachment. A fake login form is presented and a potential victim is led to believe a password is needed to verify the content of an invoice.

Behind the scenes, the password entered is submitted to a fake domain - hxxps://nistairlifts[.]co[.]uk/Opentex/script.php

There is no difference in opening the HTML file from the e-mail client or in a browser.

Example

---

Prevention

If you are uncertain about the authenticity of an email, do not hesitate to contact the entity that seems to have sent you the email using a safe communication manner, using the phone for example (no phone number from the untrusted email must be used in order to verify the authenticity).
If you are working for the Luxembourgish government or are using any of the GOVCERT.LU services, it is important to forward phishing emails to us (using Reporting an incident or the Outlook button). This will allow us to take down phishing websites and protect members of our constituency.