Weekly Phishing Email Distribution Cases (7/14/2024 – 7/20/2024)

in this post, we provide information (email subject line, attachments, URLs) on the distribution of phishing email attacks identified during the week of July 14 – July 20, 2024. we will distinguish between the type of fake login page (FakePage) and the type of malware (information leakage, downloader, vulnerability, backdoor, etc.). the phishing emails covered in this case study are only those with attachments. the number in the email subject line and attachment name is usually a unique ID value, which can vary depending on the recipient of the email.

fake login page (FakePage)

malware (Infostealer, Downloader, etc.)

fakePage C2 address

Hxxps://submit-form[.]com/SvVu5tRkA
hxxps://boresacapitals[.]com/utu/ee[.]php
hxxps://submit-form[.]com/dueEDf5xa
hxxps://www1[.]jacksonville420doctor[.]com/post[.]php
hxxps://submit-form[.]com/0Gm2c6Bg9
hxxps://zenatianx[.]cc/yHmwoiu/feedback[.]php
hxxps://espindolasound[.]com[.]ar/Ui/ado[.]php
hxxps://nocodeform[.]io/f/66381fbc05215684434c1ae9
hxxps://securelifescience[.]com/olux/ado[.]php
hxxps://nocodeform[.]io/f/667d83ed0a9124d5cdf5c23d
hxxps://jaibajrang[.]za[.]com/check/dhlphpoyin[.]php
hxxps://nocodeform[.]io/f/6624e429315208634a3467f9
hxxps://nocodeform[.]io/f/669106c6a0d285e59d82f567
hxxps://nocodeform[.]io/f/6696feb49235ae3cc0c02279
hxxps://nocodeform[.]io/f/65a9f8c62f0a543b6ef34165
hxxps://nocodeform[.]io/f/6696e705b20c4b57de1c245a
hxxps://nocodeform[.]io/f/6689d03dc29e5e1f31567362
hxxps://nocodeform[.]io/f/6694658d0d105ac7a09863eb