Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
To: [Recipient Email Address]
Shareholders requests your signature on
Salary Increase Request - [Recipient Email Address]
Review and sign
This document is for [Recipient Email Address]
Please review and sign.
After you sign Salary Increase Request, the agreement will be sent to HR Department
Then, all parties will receive a final PDF copy by email.
Don't forward this email: If you don't want to sign, you can delegate to someone else.
Adobe Employee Incentive Fake Document Credential Phishing Attack
This link-based attack impersonates Adobe using an employee incentive theme and a fake document theme to steal credentials.
Dear User
Your mailbox storage has reached 98% on the email server. Visit OutlookStorage Access Page to adjust your Mailbox storage.
Note: To access your Outlook account for upgrade a notification call will come through your phone, kindly answer the call and then press 1 on your phone to continue.
Warm Regards,
Webmail Administrator
Outlook Mailbox Storage Warning Credential Phishing Attack
This link-based attack impersonates Outlook using an external compromised account and a mailbox storage warning theme to steal credentials.
Hi.
I have bad news for you. Unfortunately, something bad happened.
One of your credentials was compromised, and that led to a chain of events that I will explain to you now.
Using your password, our team got access to your email. We downloaded all data, and with some effort used it to get access to your backup files.
Nothing could have prevented this.
The data that we have downloaded, contains your personal photos and videos, chats, documents, emails, contacts, your browsing history, notes, social media history and more, including some deleted files.
I am sure that you dont want any part of your private information to be seen by other people. And you can stop this.
If we dont get what we are asking for, we will use this information against you.
If you are not sure of what can be done, just imagine what would happen if we use your email and phone number to send the most private and damaging content to your contacts.
That would be very damaging to you.
However, there is a solution. You can avoid this mess by paying a fee to delete the files we have.
So let's make this simple. You pay $1500 USD, and there will be nothing to worry about. No chats, no photos, nothing.
Use Bitcoin to make the transfer. Wallet address is 1JaSs2bTAYVbj6jaqD5Mjfs8gSLYgvYCrK , it's unique and we will know that you made the payment immediately.
You have 2 days to make the transfer, that's reasonable.
Take care.
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a self-addressed spoofed email and a fake malware infection theme to demand a payment.
Good Morning [Recipient First Name] ,
I trust you are doing very well. I'm looking forward to surprising some staff with Gifts and other incentives for their hard work and dedication. What do you suggest we surprise them with? We have other plans in place to ensure workflow and efficiency. Email me once you receive this.
[Impersonated Employee Name]
[Impersonated Employee Title]
sent from my mobile device.
Employee Impersonation Employee Incentive Gift Card Request BEC Attack
This text-based BEC attack impersonates an employee using a spoofed display name, a free webmail account, and an employee incentive theme to request the purchase of gift cards.
Verify Your Email Address
Thank you for creating a Blockchain account. Verify your email below to complete your setup.
Yes, I Confirm This Is My Email Address
Use your unique Wallet ID to log into your Blockchain wallet.
Blockchain Account Verification Credential Phishing Attack
This link-based attack impersonates Blockchain using a look-alike domain and an account verification theme to steal credentials.
Trust you're good? I need to change my direct deposit for payroll. My present account on file is no longer active. I’m putting in a replacement account.
You will probably be needing my new account and routine numbers?
Kind Regards
[Executive First Name]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, a spoofed display name, and a maliciously registered domain to divert payroll deposits to a fraudulent account.
Your Wix account has been temporarily suspended
We want to give you every chance to save your services. You may get this email again if you don't update your payment details.
Renew Now
Please do not reply to this email. Emails sent to this address will not be answered.
Wix Suspended Account Credential Phishing Attack
This link-based attack impersonates Wix using a maliciously registered domain and a suspended account theme to steal credentials.
Hello,
Please find attached your application rejection document. Kindly view and revisit our portal to provide the details needed.
Regards,
IRS
IRS Fake Document PDF Attachment Credential Phishing Attack
This payload-based attack impersonates IRS using a fake document theme to steal credentials.
Hello,
We have tried contacting you on numerous occasions regarding the following unpaid invoice which is now over 30 days overdue: INV934
This matter has now reached a critical point and we require immediate payment of this amount to avoid further action. Please contact me immediately to advise when we can expect payment of this outstanding amount.
Thanks in advance for your understanding and cooperation.
Thank you,
[Vendor Employee Name] | [Vendor Employee Title] | [Vendor Company Name]
[Vendor Contact Information]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a maliciously registered domain and an overdue payment theme to request a fraudulent payment.
Paid 05/12/2022
$124,67.90
Print or save
Powered by QuickBooks
Dear [Recipient Username] ,
Here's your invoice! We appreciate your prompt payment.
Thanks for your business!
5642 Belleza Dr Pleasanton, CA 94588 US
Fake Invoice Link-based Malware Attack
This link-based attack impersonates a vendor/supplier using a self-addressed spoofed email and a fake invoice theme to deliver malware.
