Explanation
The goal of this phishing campaign is to steal LuxTrust credentials.
The email claims that access to BILnet needs to be secured according to ‘new European Banking Directives’. For this, an authentication via LuxTrust is needed. By clicking on the ‘Authentication’-button, the user is redirected to a malicious website. The website asks for the users LuxTrust login credentials as well as his email address. After filling out all information, the LuxTrust authentication panel is shown and asks to validate the pending process.
All the steps have taken place on pages under the malicious domain ‘jili567[.]org’ .
Example