Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hello!
Unfortunately, I have some unpleasant news for you.
Roughly several months ago I have managed to get a complete access to all devices that you use to browse internet.
Afterwards, I have proceeded with monitoring all internet activities of yours.
You can check out the sequence of events summarize below:
Previously I have bought from hackers a special access to various email accounts (currently, it is rather a straightforward thing that can be done online).
Clearly, I could effortlessly log in to your email account as well ([Recipient Email Address]).
One week after that, I proceeded with installing a Trojan virus in Operating Systems of all your devices, which are used by you to login to your email.
Actually, that was rather a simple thing to do (because you have opened a few links from your inbox emails previously).
Genius is in simplicity. ( ~_^)
Thanks to that software I can get access to all controllers inside your devices (such as your video camera, microphone, keyboard etc.).
I could easily download all your data, photos, web browsing history and other information to my servers.
I can access all your social networks accounts, messengers, emails, including chat history as well as contacts list.
This virus of mine unceasingly keeps refreshing its signatures (since it is controlled by a driver), and as result stays unnoticed by antivirus software.
Hereby, I believe by this time it is already clear for you why I was never detected until I sent this letter...
While compiling all the information related to you, I have also found out that you are a true fan and frequent visitor of adult websites.
You truly enjoy browsing through porn websites, while watching arousing videos and experiencing an unimaginable satisfaction.
To be honest, I could not resist but to record some of your kinky solo sessions and compiled them in several videos, which demonstrate you masturbating and cumming in the end.
If you still don't trust me, all it takes me is several mouse clicks to distribute all those videos with your colleagues, friends and even relatives.
In addition, I can upload them online for entire public to access.
I truly believe, you absolutely don't want such things to occur, bearing in mind the kinky stuff exposed in those videos that you usually watch, (you definitely understand what I am trying to say) it will result in a complete disaster for you.
We can still resolve it in the following manner:
You perform a transfer of $1590 USD to me (a bitcoin equivalent based on the exchange rate during the funds transfer), so after I receive the transfer, I will straight away remove all those lecherous videos without hesitation.
Then we can pretend like it has never happened before. In addition, I assure that all the harmful software will be deactivated and removed from all devices of yours. Don't worry, I am a man of my word.
It is really a good deal with a considerably low the price, bearing in mind that I was monitoring your profile as well as traffic over an extended period.
If you still unaware about the purchase and transfer process of bitcoins - all you can do is find the necessary information online.
My bitcoin wallet is as follows: 1MW4maqRuqi62YiRNMaBiHT65WJJMEAvQw
You are left with 48 hours and the countdown starts right after you open this email (2 days to be specific).
Don't forget to keep in mind and abstain from doing the following:
> Do not attempt to reply my email (this email was generated in your inbox together with the return address).
> Do not attempt to call police as well as other security services. Moreover, don't even think of sharing it with your friends. If I get to know about it (based on my skills, that would be very easy, since that I have all your systems under my control and constant monitoring) - your dirty video will become public without delay.
> Don't attempt searching for me - it is completely useless. Cryptocurrency transactions always remain anonymous.
> Don't attempt reinstalling the OS of your devices or even getting rid of them. It is meaningless too, because all your private videos are already been available on remote servers.
Things you should be concerned about:
> That I will not receive the funds transfer you make.
Relax, I will be able to track it immediately, after you complete the funds transfer, because I unceasingly monitor all activities that you do (trojan virus of mine can control remotely all processes, same as TeamViewer).
> That I will still distribute your videos after you have sent the money to me.
Believe me, it is pointless for me to proceed with troubling you after that. Besides that, if that really was my intention, it would happen long time ago!
It all will be settled on fair conditions and terms!
One last advice from me... Moving forward make sure you don't get involved in such type of incidents again!
My suggestion - make sure you change all your passwords as often as possible.
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a fake malware infection theme to demand a payment.
Metamask requires all users to verify their wallets in order to comply with the new guidelines. You must verify your wallet before 3/5/2022 to continue using our service.
What if I don’t complete the wallet verification?
If you don’t verify your wallet, your wallet will be restricted.
Verify my wallet
Metamask Account Verification Cryptocurrency Credential Phishing Attack
This link-based attack impersonates Metamask using a maliciously-registered domain, an account verification theme, and a cryptocurrency theme to steal credentials.
Hey!
Hope you are doing well!
I have recently changed banks and would like to have my direct deposit updated to my new bank account. Can you please ensure the change is effective immediately for the next pay date?
Thanks!
[Impersonated Executive Name]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using email address spoofing and a maliciously registered domain to divert payroll deposits to a fraudulent account.
Dear Customer:
We have temporarily prevented online access to your account.
For your security, chase safeguards your account when there is a possibility
that someone other than you is attempting to sign in.
For immediate access to your account, please Sеcurе Rеviеw.
Note: This may have happened because you're using a device you don't usually use or you cleared the cookies on your browser. (Cookies are how we remember you.
Additional information is required by administrator to complete this update process.
Thank you for helping us keep your account safe.
Sincerely,
Online Banking Team
Chase Suspicious Account Activity Credential Phishing Attack
This link-based attack impersonates Chase using suspicious account activity theme to steal credentials.
Your Package Waiting For Delivery
Dear Customer.
You have to put all the data from accurate information in order for us to reach your address to receive your package
Cost Delivery: 2.99$
Sincerely,
USPS USA
Check Your Package
USPS Fake Shipping Notification Credential Phishing Attack
This link-based attack impersonates USPS using a spoofed email account and a fake shipping notification theme to steal credentials.
Action Required: Closure of your Robinhood account
Hi,
Our systems recently identified charges that appear to be unauthorized by the customer, meaning that the owner of the account did not consent to these payments. This means that we can no longer accept payments for your account.
Refunds on card payments will be issued in 5 business days, although they may take longer to appear on the cardholder's statement. Please refer to your Dashboard for a list of the charges to be refunded. If there are insufficient funds on your account to cover any refunds, these refunds will not be processed and any outstanding funds will remain on your account.
What you can do
If you believe that we've made a mistake, we'd like to remedy the situation as quickly as possible. To help us effectively revisit your account, please complete the below verification form:
Complete verification
Once verification has been completed, we will re-review your account within 24-48 hours.
If you have any questions, please contact customer support. We're here to help.
- The Robinhood Team
Robinhood Account Verification Credential Phishing Attack
This link-based attack impersonates Robinhood using a spoofed email address and an account verification theme to steal credentials.
HR@[Recipient Company Domain] shared a folder with you.
Please upload your documents in the bonus folder for 2022. .
Bonus Payments 2022
This link will work for [Recipient Email Address]..
Open
Microsoft Employee Incentive Fake Document Credential Phishing Attack
This link-based attack impersonates Microsoft using email spoofing, an employee incentive theme, and a fake document theme to steal credentials.
Hi,
Please pay the below payment as a same-day transfer and send me a copy of the payment as an attachment
Regards
-----Original Message-----
From: HMRC
Sent: Monday, September 07 ,2021 03:45 PM
To: Finance
Subject: DTA 2021 due Payment
Below are HMRC bank details to process payment for the 2021 corporation tax due by 08/08/2021. Kindly note that payment should be processed as CHAPS/Same day value payment.
Sort Code/Routine [Account Detail]
Acct No [Account Number]
Payment Ref 9796919229A00118A
Amount £12,740
Let me have the remittance receipt as an attachment.
Thank you,
[Impersonated Executive Name]
Executive Impersonation Fake Email Chain Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a fake email chain, display name spoofing, and a maliciously registered domain to request a fraudulent payment.
New Document Shared for Review!
From a Personal/Business Computer:
Open the enclosed attachment:
Note: the image above is only the first of the attached document.
To view more than the first page, Open the attachment or..
GoTo Documents
SharePoint Fake Document Credential Phishing Attack
This link-based attack impersonates SharePoint using an external compromised account and a fake document theme to steal credentials.
Good Day,
I have attempted to contact you several times, but you have not responded; when will your outstanding be paid?
In addition, we have changed our ACH/Wire information to a new bank account.
Please inform me of the status of the payment.
Regards,
Vendor Impersonation Payment Fraud Overdue Payment Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using display name spoofing, a look-alike domain, an overdue payment theme, and a payment account update theme to request a fraudulent payment.
