They told me to check my retirement savings balance, but now they’re asking for my password?

You should also be wary of emails urging you to check the status of your retirement pension fund—a topic that might interest office workers. Recently, phishing emails have been identified that use retirement pension notifications as a pretext to steal email account information. Under the pretext of verifying a secure email, threat actors trick recipients into opening an HTML file; instead of displaying the actual document, a fake login screen appears, prompting them to enter their password. It has also been confirmed that a legitimate web form submission service was exploited as a path for account information leakage during this process. Let’s examine the attack process and response methods for phishing emails that disguise themselves as retirement pension notifications.

The email was disguised as a notice from a financial institution, prompting recipients to check the status of their retirement pension fund assets as of September 2026. The threat actor instructed recipients to download and open the attached HTML file to view the “secure email.”

HTML is a file format used to construct web pages; when opened in a browser, it displays a screen in the form of a web page. The threat actor exploited such a feature to make a phishing page appear when the recipient opened the Attachment.

A Fake Login Screen with the Email Address Already Pre-filled

When a user opens the attached HTML file, a phishing page that disguises itself as a login page for viewing the document appears. The recipient’s email address is already pre-filled on this page and cannot be modified. This is designed to trick the user into believing they are going through a legitimate authentication process.

Once the user enters their password and clicks the “View File” button, their email address, password, browser information, and the time of entry are transmitted externally. The threat actor exploited Web3Forms, a legitimate web form submission service, to steal this information.

[Figure 1] Phishing page created under the pretense of viewing a file

Web3Forms is a service that forwards form data entered on a website via email. In this attack, information collected through the phishing page was sent to the Web3Forms API, and analysis revealed that the threat actor received this information at the email address linked to the Access Key.

[Figure 2] Example of account information transmitted via Web3Forms (using a test password)

Things to Check When Receiving Emails About Retirement Pensions

You should never blindly trust emails that appear to be sent by financial institutions or login screens contained in Attachments. To prevent Information Theft, you must verify the following points from the moment you check the email until you enter your login credentials.

1. Verify
   the sender’s email address: If the email appears to be from a financial institution or company, verify that the sender’s email address uses an official domain. Do not assume the email is legitimate based solely on the sender’s name or the organization’s name displayed in the message.

2. Check
   links and attachments: Before clicking on images or links in the email body, verify the URL they lead to. Be cautious of intermediate paths, as suspicious links may redirect through other websites before finally reaching a legitimate page. You should also check the file extensions of attachments and avoid carelessly opening EXE files or script files (.Vbs, .Js) from unknown sources. Remember that HTML files can also be exploited for phishing, as seen in this case.

3. Verify
   the Website Address Before Entering Sensitive Information Before entering sensitive information, such as login passwords, you should verify that the page’s URL matches that of the official website. You should also check whether HTTPS is enabled and look for the browser’s secure connection indicator. However, the presence of HTTPS or a padlock icon does not necessarily mean the site is legitimate, so you should not enter any information on suspicious pages.

If you receive an email regarding financial matters, such as a retirement pension, it is safer to access the financial institution’s official website or app directly to verify the information rather than opening any Attachments or links immediately.

Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.