Weekly Phishing Email Distribution Cases (June 9th, 2024 – June 15th, 2024)

This post will cover the distribution cases of phishing emails during the week from June 9th, 2024 to June 15th, 2024, and provide the associated information (email subject, attachments, URLs). The cases will be classified into Fake login page (i.e. FakePage) and malware types (i.e. Infostealer, Downloader, Exploit, Backdoor, etc.). The phishing emails covered in the distribution cases will be limited to those that have attachments. The numbers in email subjects and attachment filenames are unique IDs and may vary depending on the email recipient.

FakePage

Malware (Infostealer, Downloader, etc.)

FakePage C2 URL

hxxps://dev-vanilabid[.]pantheonsite[.]io/fser/dhl
hxxps://abczyx[.]ru[.]com/manfai/dhl
hxxps://nocodeform[.]io/f/6639de959045815fcb17f9c2
hxxps://araucariapeche[.]com/loginx[.]php
hxxps://globalityinvestment[.]com/current/dhl
hxxps://readmemag[.]com/mp/cd/dhl[.]php
hxxps://fil382[.]com/rp/ui[.]php
hxxps://app[.]form2chat[.]io/f/fa425077
hxxps://nocodeform[.]io/f/6624e429315208634a3467f9
hxxps://yourhealingtoday[.]com/niyi/excel[.]php
hxxp://thliyosa[.]mypi[.]co/logs[.]php
hxxps://airtekincheatingandcooling[.]com/abasel/docusign[.]php
hxxps://nocodeform[.]io/f/6664735a05b8909df2b20714
hxxps://www1[.]jacksonville420doctor[.]com/post[.]php
hxxps://smartforms[.]dev/submit/6666f1195df1517d48d8f346
hxxps://submit-form[.]com/1Bh1x20ne
hxxps://app[.]form2chat[.]io/f/5ef8f443
hxxps://smartforms[.]dev/submit/66689dcf5df1517d48d8f3cd
hxxps://data[.]endpoint[.]space/clxa9q4jn004308jr7ln69d9r
hxxps://app[.]form2chat[.]io/f/d4e4d332
hxxps://kanyinicare[.]com[.]au/wp-includes/AMA/Excle[.]php
hxxps://alpro[.]info/x/send[.]php
hxxps://nz576[.]com/Preview/OneDrive-Attach-MMp/result[.]php