Stewart Title Company Real Estate Transaction Fake Document Credential Phishing Attack

Initial Email Content

Subject

****Closing Package (CD) and Wiring Instructions Attached****

Body

Hello team,

Please download the documents now and store them for your records.

Download Documents

Sign into your account for more options

-Commitment for Title Insurance

-Tax Certificate

-Wiring Instructions

-Insured Closing Letter

-Preliminary CD

-Vesting Deed

-Survey-has been ordered will send over to you once it has been received and reviewed.

-HOA

-Hazard Insurance – Please provide a copy of the insurance Dec. Page

Please let us know if you have any questions.

Attack Screenshots

No items found.

Malicious Artifacts

Additional Indicators of Compromise

Type

Description

No items found.

Attack Description

This link-based attack impersonates Stewart Title Company using an external compromised account, a real estate transaction theme and a fake document theme to steal credentials.

Analysis Overview

Type

Credential Phishing

Tactic

External Compromised Account

Goal

Credential Theft

Impersonated Party

Vector

Link-based

Theme

Real Estate Transaction

Fake Document

Language