TELEGRAMPHISHING

Phishing Script File Breaching User Information via Telegram Being Distributed

AhnLab Security Emergency response Center (ASEC) has recently identified circumstances of multiple phishing script files disguised as PDF document viewer screens being distributed as attachments to emails. A portion of the identified file names are as below, and keywords such as purchase order (PO), order, and receipt were used. New order_20230831.html Salbo_PO_20230823.pdf.html WoonggiOrder-230731.pdf.html PO_BG20231608-019.html ○○○ Pharma.pdf.html DH○_BILL_LADING_DOCUMENT_RECEIPT.html _Purchase Order Received from ○○○ Cosmetics_msg (email) BL_148200078498.html En○○○ Purchase Order.html Sung○○ BioX_New PO.pdf.html As shown in Figure 1 below, a blurred image…