Weekly Phishing Email Distribution Cases (June 23rd, 2024 – June 29th, 2024)

This post will cover the distribution cases of phishing emails during the week from June 23rd, 2024 to June 29th, 2024, and provide the associated information (email subject, attachments, URLs). The cases will be classified into Fake login page (i.e. FakePage) and malware types (i.e. Infostealer, Downloader, Exploit, Backdoor, etc.). The phishing emails covered in the distribution cases will be limited to those that have attachments. The numbers in email subjects and attachment filenames are unique IDs and may vary depending on the email recipient.

FakePage

Malware (Infostealer, Downloader, etc.)

FakePage C2 URL

hxxps://nocodeform[.]io/f/65b3a748ebfd5678a2950a23
hxxps://fastomod[.]sa[.]com/AA/dhl
hxxps://formspree[.]io/f/myyazkbv
hxxps://submit-form[.]com/qbFkUMkV0
hxxps://nocodeform[.]io/f/6674b6f48d48127858fe3776
hxxps://xn--90aohb4am9a5bc[.]xn--p1ai/wp-admin/pr3/ecxel[.]php
hxxps://atacadoparis[.]sobraldesign[.]com[.]br/wp-includes/connect/on3[.]php
hxxps://khoms222[.]ir/au/js/nike/sc/lognet[.]php
hxxps://aerosch[.]com/hc[.]php
hxxps://periculium[.]cc/OfSMqa/feedback[.]php
hxxps://dilijancentralschool[.]am/wp-admin/fr/ecxel[.]php
hxxps://nocodeform[.]io/f/6674d720e45da2dd53f524a5
hxxps://nocodeform[.]io/f/6678b8ad7930bdadc0e47748
hxxps://www[.]krabiview[.]com/wp-content/themes/twentythirteen/jor/pdff-index[.]php
hxxps://aerosch[.]com/hs-[.]php
hxxps://ronlunsford[.]ru[.]com/as/exc[.]php
hxxps://nocodeform[.]io/f/65b6d66c782c5cb3cd66446f
hxxps://janmmers[.]com/stn/pdff-index[.]php
hxxps://app[.]form2chat[.]io/f/5ef8f443