Weekly phishing email Distribution Cases (7/7/2024 – 7/13/2024)

in this post, we provide information (email subject line, attachments, URLs) of phishing email attacks that we identified during the week of July 7-13, 2024. we will distinguish between the type of fake login page (FakePage) and the type of malware (information leakage, downloader, vulnerability, backdoor, etc.). the phishing emails covered in this case study are only those with attachments. the number in the email subject line and attachment name is usually a unique ID value, which can vary depending on the recipient of the email.

fake login page (FakePage)

malware (Infostealer, Downloader, etc.)

fakePage C2 Address

Hxxps://submit-form[.]com/LYUcPTlNS
hxxps://securelifescience[.]com/olux/ado[.]php
hxxps://formspree[.]io/f/xdovobje
hxxps://zenatianx[.]cc/AhMaUyj/feedback[.]php
hxxp://nb[.]brvv5[.]za[.]com/[.]ll/bold/dhlphpoyin[.]php
hxxps://nocodeform[.]io/f/66381fbc05215684434c1ae9
hxxps://controlvisualch[.]com/wp-mm/kl/ado[.]php
hxxps://nb[.]brvv5[.]za[.]com/[.]ll/bold/lex/dhlphpoyin[.]php
hxxps://kr[.]startupaccelerators[.]za[.]com/Jordan/pdff-index[.]php
hxxps://nocodeform[.]io/f/667d836646ff8e3f53a1bb15
hxxps://submit-form[.]com/CHrPonEFp
hxxps://nocodeform[.]io/f/661be8df72405f9192c1cc4b
hxxps://nocodeform[.]io/f/6638105ce8e699c9d861d18f
hxxps://elojobsky[.]com/norway/login[.]php
hxxps://daquitanda[.]online/lognet1[.]php
hxxps://controlvisualch[.]com/wp-mm/emz/ado[.]php