Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hi [Recipient First Name],
Are you in today?
Is there a full list of receivables aging reports that I might look at? including contact information (email and phone numbers)? Please create a spreadsheet and send it to me via email as soon as feasible.
Thank you very much
[Executive Name]
[Executive Title] at [Company Name]
Executive Impersonation Aging Report Compromise BEC Attack
This text-based BEC attack impersonates an executive using a spoofed display name and a free webmail account to request a copy of an aging report.
Dear [Recipient Name] & Accounts Team,
Please note that all current/outstanding invoices have been sent .Kindly confirm receipt for more information and instructions.Note also that the invoices for December, 2021 to March, 2022 appear to be in arrears.We request that you kindly provide the status of these invoices with proofs of payment if remittances have been made already against any of these invoices in question so as to enable us update our records and accounts accordingly.
Thanks for your cooperation. We await your prompt response.
My best regards
[Vendor Employee Name]
General Manager Accounts
Head of CAT / CO2 (Collection of Air Navigation Charges)
CRCO / CAT / CO2
EUROCONTROL
96 Rue de la Fusée, 1130 Brussels, Belgium
Email: [Username]@eurocontrolint.com
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain and an overdue payment theme to request a fraudulent payment.
Dear Valued ADP Client,
Account operator refused payroll operation on your ADP® Employee Access® account.
For your security, kindly verify your account by clicking on the button below.
This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.
Important: Please be advised that calls to and from your Service Team may be monitored or recorded.
Please do not respond to this message. It comes from an unattended mailbox.
ADP Account Verification Credential Phishing Attack
This link-based attack impersonates ADP using a free webmail account and an account verification theme to steal credentials.
(no text content - anchor image only)
Office365 Password Expiration Credential Phishing Attack
This link-based attack impersonates Office365 using a hijacked email thread, a content obfuscation via image, an external compromised account, and a password expiration theme to steal credentials.
Hi
Our records show that we haven’t yet received payment for Invoice 992890, which is overdue by 3 months. I would appreciate it if you could check this out on your end. If the payment has already been sent, please disregard this notice. And if you’ve lost this invoice, please let me know, and I’d be happy to send you another copy.
Regards,
[Impersonated Vendor Employee Name]
[Impersonated Vendor Company Name]
[Impersonated Vendor Company Address]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, a spoofed display name, and an overdue payment theme to request a fraudulent payment.
[Compromised Third Party Employee Name] sent you a document to review and sign.
REVIEW DOCUMENT
Thank you,
[Compromised Third Party Employee Name]
[Compromised Third Party Company Name]
[Compromised Third Party Company Contact Information]
Evernote Fake Document Credential Phishing Attack
This link-based attack impersonates Evernote and an external third party using a content obfuscation via image, an external compromised account, and a fake document theme to steal credentials.
--
Hallo [Recipient First Name],
Ich habe eine Telefonkonferenz und möchte, dass Sie eine kurze Aufgabe für mich erledigen.
Senden Sie mir Ihre bei WhatsApp registrierte Telefonnummer und warten Sie auf meine Nachricht.
Mit freundlichen Grüßen.
Von meinem Iphone gesendet.
German Executive Impersonation Gift Card Request BEC Attack
This text-based German-language BEC attack impersonates an executive using a WhatsApp number request, a spoofed display name, and a free webmail account to request the purchase of gift cards.
Attention,
After numerous attempts to reach you, we haven't received any payment or any positive feedback from your side, as you are not paying your seriousness on this account which means that you are trying to run away from the situation and repeating the same activity which you did before with the loan company. We tried our best to help you on this matter but you are taking this matter lightly.
Account Status: WARRANT IS ACTIVE FOR SEARCH AND SEIZE (Violation of the Fair Debt Collection Practices Act and Defamation of Character.)
"Debtor (You) has been declared as a guilty by Authorized Law Enforcement Department, Seizure Warrant has been activated under 15 USC 1692g Sec. 809 (b) of the FDCPA”
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare as required by law and promptly return this warrant. Pursuant to 18 U.S.C. § 3103a (b), I find that immediate notification may have an adverse result listed in 18 U.S.C. 2705 (except for the delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched or seized.
Note: You will be contacted by your local county authorities. National Debt Recovery Department is closing this account and declaring as a GUILTY. If we will not receive any feedback from your side, then you will be the only person who will be responsible for any consequences.
NOTE: YOU STILL HAVE CHANCE TO RECTIFY THIS OUTSIDE OF COURT, FOLLOW THE RESOLVEMENT PROCEDURE BELOW
IF YOU WANT TO RESOLVE CASE OUTSIDE OF COURT THEN CONTACT TO RESTITUTION DEPARTMENT: - mailto:attorney.richard.l.beaver@gmail.com
CREDITOR: CASH NET USA.
Regards,
Restitution Head
Department of Debt Settlement
Confidentiality Statement & Notice: This email is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521 and intended only for the use of the individual or entity to which it is addressed. Any review, retransmission, dissemination to unauthorized persons or other use of the original message and any attachments is strictly prohibited. If you received this electronic transmission in error, please reply to the above-referenced sender about the error and permanently delete this message. Thank you for your co-operation.
Debt Collection Legal Matter Extortion Attack
This text-based extortion attack uses a free webmail account, a debt collection theme, and a legal matter theme to demand a payment.
[Recipient First Name], I'll need you to process an outgoing payment today via Wire
or Zelle for an Operating Expenses which is due.
Kindly let me know if you can get it done today via Wire or Zelle so i
can forward you the details for the payment.
Thanks
[Impersonated Employee First Name]
Employee Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an employee using a spoofed display name and a free webmail account to request a fraudulent payment.
Good day
hope you're well and had a good weekend.
We are writing in reference to an overdue invoice, we kindly ask that you reassert to us the status of our outstanding or any due if there are any, as we currently have to give you an updated information.
Please get back to us immediately with the total amount that is outstanding with corresponding due dates and invoices respectively.
kindly hold off on any payment due.
[Vendor Employee Name] - Sales Manager
[Vendor Company Address]
Inside Sales: invoice.outstanding@accountant.com
Vendor Impersonation Overdue Payment Payment Inquiry BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a spoofed email address, a free webmail account, an overdue payment theme, and a payment inquiry theme to request a fraudulent payment.
