First American Title Fake Document Credential Phishing Attack
Initial Email Content
In order to serve you better now and in the future, First American has a Secure E-Mail system. As a result, all users will be prompted to register a user name and password the first time they access this system.
You have received an encrypted Secure E-Mail from the First American Financial Corporation or one of its subsidiaries that may contain private and/or sensitive data. If you have questions or concerns about this secure E-Mail Notification, please contact your First American representative. Always be on the lookout for phishing. Information on legitimate links and how to identify spoofed emails may be found on our website firstam.com by searching "phishing."
Click here to read your secure message, which expires 2022-05-03 11:59 PDT. Please save or export this message and any attachments to a separate system before the expiration to avoid losing this information.
More Info
Attack Screenshots
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This link-based attack impersonates First American Title using an external compromised account and fake document theme to steal credentials.