Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Jakie jest saldo naszego konta? dzisiaj musimy zapłacić 48.100 Euro.
Z poważaniem
[Executive First Name]
Polish Executive Impersonation Payment Fraud BEC Attack
This text-based Polish-language BEC attack impersonates an executive using a spoofed email address and a free webmail account to request a fraudulent payment.
Verify Your Email Address
Thank you for creating a Blockchain account. Verify your email below to complete your setup.
Yes, I Confirm This Is My Email Address
Use your unique Wallet ID to log into your Blockchain wallet.
Blockchain Account Verification Credential Phishing Attack
This link-based attack impersonates Blockchain using a look-alike domain and an account verification theme to steal credentials.
Good Morning [Recipient First Name] ,
I trust you are doing very well. I'm looking forward to surprising some staff with Gifts and other incentives for their hard work and dedication. What do you suggest we surprise them with? We have other plans in place to ensure workflow and efficiency. Email me once you receive this.
[Impersonated Employee Name]
[Impersonated Employee Title]
sent from my mobile device.
Employee Impersonation Employee Incentive Gift Card Request BEC Attack
This text-based BEC attack impersonates an employee using a spoofed display name, a free webmail account, and an employee incentive theme to request the purchase of gift cards.
Hi.
I have bad news for you. Unfortunately, something bad happened.
One of your credentials was compromised, and that led to a chain of events that I will explain to you now.
Using your password, our team got access to your email. We downloaded all data, and with some effort used it to get access to your backup files.
Nothing could have prevented this.
The data that we have downloaded, contains your personal photos and videos, chats, documents, emails, contacts, your browsing history, notes, social media history and more, including some deleted files.
I am sure that you dont want any part of your private information to be seen by other people. And you can stop this.
If we dont get what we are asking for, we will use this information against you.
If you are not sure of what can be done, just imagine what would happen if we use your email and phone number to send the most private and damaging content to your contacts.
That would be very damaging to you.
However, there is a solution. You can avoid this mess by paying a fee to delete the files we have.
So let's make this simple. You pay $1500 USD, and there will be nothing to worry about. No chats, no photos, nothing.
Use Bitcoin to make the transfer. Wallet address is 1JaSs2bTAYVbj6jaqD5Mjfs8gSLYgvYCrK , it's unique and we will know that you made the payment immediately.
You have 2 days to make the transfer, that's reasonable.
Take care.
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a self-addressed spoofed email and a fake malware infection theme to demand a payment.
Dear User
Your mailbox storage has reached 98% on the email server. Visit OutlookStorage Access Page to adjust your Mailbox storage.
Note: To access your Outlook account for upgrade a notification call will come through your phone, kindly answer the call and then press 1 on your phone to continue.
Warm Regards,
Webmail Administrator
Outlook Mailbox Storage Warning Credential Phishing Attack
This link-based attack impersonates Outlook using an external compromised account and a mailbox storage warning theme to steal credentials.
Hello,
We have tried contacting you on numerous occasions regarding the following unpaid invoice which is now over 30 days overdue: INV934
This matter has now reached a critical point and we require immediate payment of this amount to avoid further action. Please contact me immediately to advise when we can expect payment of this outstanding amount.
Thanks in advance for your understanding and cooperation.
Thank you,
[Vendor Employee Name] | [Vendor Employee Title] | [Vendor Company Name]
[Vendor Contact Information]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a maliciously registered domain and an overdue payment theme to request a fraudulent payment.
Hello,
Please find attached your application rejection document. Kindly view and revisit our portal to provide the details needed.
Regards,
IRS
IRS Fake Document PDF Attachment Credential Phishing Attack
This payload-based attack impersonates IRS using a fake document theme to steal credentials.
Your Wix account has been temporarily suspended
We want to give you every chance to save your services. You may get this email again if you don't update your payment details.
Renew Now
Please do not reply to this email. Emails sent to this address will not be answered.
Wix Suspended Account Credential Phishing Attack
This link-based attack impersonates Wix using a maliciously registered domain and a suspended account theme to steal credentials.
Trust you're good? I need to change my direct deposit for payroll. My present account on file is no longer active. I’m putting in a replacement account.
You will probably be needing my new account and routine numbers?
Kind Regards
[Executive First Name]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, a spoofed display name, and a maliciously registered domain to divert payroll deposits to a fraudulent account.
Your credit card payment is pending and waiting for approval.
Account ending in: 4642
Payment amount: $12461.77
Effective date: 05/13/2022
Payment authorized on: 05/10/2022
See payment activity
Click Here To Decline or Accept
If you pay between 8 PM ET and 11:59 PM ET, we’ll credit your account for the date you chose, but you might not see it for 1-2 days.
If you pay after 8 PM ET on your due date and you pay at least the minimum amount due, you’ll see a late fee on your account that will be reversed automatically when the payment posts in 1-2 days.
We’ll process this one-time electronic payment as scheduled.
To cancel a payment scheduled for a future date, please visit us at chase.com or in our app.
Chase Fake Payment Receipt Credential Phishing Attack
This link-based attack impersonates Chase using an external compromised account and a fake payment receipt theme to steal credentials.
