Executive Impersonation Overdue Payment Payment Fraud BEC Attack
Initial Email Content
Hi [Recipient First Name],
I asked Karen Page, Finance Controller at Collins Contractor LTD to contact you some days ago regarding a late invoice.
These are consulting services that CC LTD offered us, I will give you more information about it later after review.
Could you have it paid today?
Regards,
[Executive Name]
Forwarded message --------- ----------
From: Ange Page <ange.page@collins-contractor.com>
Sent: 28 April 2022 15:59
Subject: Invoice 960201 Overdue
Hi Rich,
I have sent the invoice back as a reminder. I would like to inform you that it is OverDue today.
Should we expect this payment soon?
Sincerely,
Karen Page
Financial Controller
Collins Contractors Ltd
Attack Screenshots
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This text-based BEC attack impersonates an executive using a fake email chain, a spoofed display name, a maliciously registered domain, and an overdue payment theme to request a fraudulent payment.