Weekly Phishing Email Distribution Cases (June 2nd, 2024 – June 8th, 2024)

This post will cover the distribution cases of phishing emails during the week from June 2nd, 2024 to June 8th, 2024, and provide the associated information (email subject, attachments, URLs). The cases will be classified into Fake login page (i.e. FakePage) and malware types (i.e. Infostealer, Downloader, Exploit, Backdoor, etc.). The phishing emails covered in the distribution cases will be limited to those that have attachments. The numbers in email subjects and attachment filenames are unique IDs and may vary depending on the email recipient.

FakePage

Malware (Infostealer, Downloader, etc.)

FakePage C2 URL

hxxps://nocodeform[.]io/f/665e585c34c71e7ee947b8b1
hxxps://hnsljl[.]ru[.]com/check/rob/dhlphpoyin[.]php
hxxps://nocodeform[.]io/f/665e611e6bddf4bca4970e00
hxxps://nocodeform[.]io/f/664e4b0662e2398933efe010
hxxps://formspree[.]io/f/xzbnykvp
hxxps://nocodeform[.]io/f/6660482806a92ddebb185fd6
hxxps://hnsljl[.]ru[.]com/check/dhlphpoyin[.]php
hxxps://nocodeform[.]io/f/66564d254754eeaa709919bc
hxxps://fil382[.]com/rp/ui[.]php
hxxps://bangladesh16[.]com/xx/Excel22[.]php
hxxps://hochtief-group[.]za[.]com/light/bl/dhlphpoyin[.]php
hxxps://readmemag[.]com/mp/cd/dhl[.]php
hxxps://fondosdecomercioram[.]com[.]ar/docusign[.]php
hxxps://auditx7[.]com/ebbb/loginx[.]php
hxxps://app[.]form2chat[.]io/f/f027a975
hxxps://nocodeform[.]io/f/665e694f651cc54219d92e26
hxxps://liamoraghsoundtherapy[.]com/flexxy/config[.]php
hxxps://submit-form[.]com/bjDyLJJyE