Weekly Phishing Email Distribution Cases (May 26th, 2024 – June 1st, 2024)

This post will cover the distribution cases of phishing emails during the week from May 26th, 2024 to June 1st, 2024, and provide the associated information (email subject, attachments, URLs). The cases will be classified into Fake login page (i.e. FakePage) and malware types (i.e. Infostealer, Downloader, Exploit, Backdoor, etc.). The phishing emails covered in the distribution cases will be limited to those that have attachments. The numbers in email subjects and attachment filenames are unique IDs and may vary depending on the email recipient.

FakePage

Malware (Infostealer, Downloader, etc.)

FakePage C2 URL

hxxps://www[.]krabiview[.]com/wp-content/themes/twentythirteen/ice/dhl1[.]php
hxxps://www[.]auspareparts[.]com/fed/fdx[.]php
hxxps://usebasin[.]com/f/39bc7138119c
hxxps://rendmanudinar[.]com/deydyx/slDUCj1[.]php
hxxps://qldgovtv[.]com[.]au/wp-includes/check/roboss/dhlphpoyin[.]php
hxxps://qldgovtv[.]com[.]au/wp-includes/check/dhlphpoyin[.]php
hxxps://nocodeform[.]io/f/66564d254754eeaa709919bc
hxxps://nocodeform[.]io/f/664da73d3f4df3a914dfd1eb
hxxps://nocodeform[.]io/f/662e90891940144aa5575a13
hxxps://nocodeform[.]io/f/6624e429315208634a3467f9
hxxps://nocodeform[.]io/f/65eeac6e92c04770bfb334ae
hxxps://nocodeform[.]io/f/65d3a0f1643e6d8f39f20b10
hxxps://nocodeform[.]io/f/65bbc626e4a0f048c71428f7
hxxps://nocodeform[.]io/f/65acc261677f4282f7477b44
hxxps://msunduziz[.]com/xurre/loginx[.]php
hxxps://manuelcasabielle[.]com/wp-includes/bold/dhlphpoyin[.]php
hxxps://khoms222[.]ir/au/js/OG/dhl1[.]php
hxxps://jenata-vchas[.]net/[.]well-known/pki-validation/lognet-[.]php
hxxps://hirukote[.]net/wp-includes/rr/dhlphpoyin[.]php
hxxps://gswaters[.]com/continue/exc[.]php
hxxps://formspree[.]io/f/meqydawz
hxxps://eolica[.]az/FEDEX/phpmailer[.]php
hxxps://coworkingops[.]com/error/Excel
hxxps://app[.]form2chat[.]io/f/f027a975
hxxps://app[.]form2chat[.]io/f/779f2968
hxxps://app[.]form2chat[.]io/f/1cbb2c31