Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hi [Recipient Name],
I was just informed that we have an offer accepted by a new vendor which I have been negotiating for some time now. Are you able to process the payment ? so I can forward you a copy of the invoice and W9.
Regards,
[Impersonated Executive Name]
Sent from my iPhone
Executive Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing, a maliciously registered domain, and a new vendor theme to request a fraudulent payment.
Hi [Target Name],
I am a Debt Recovery and Enforcement Officer at [Impersonated Third Party Company] I am representing a client in chasing an unpaid invoice #9784333 issued to your firm, I have been advised to contact you on this matter to get this resolved as soon as possible.
Thanks.
James Dinoi
Debt Recovery and Enforcement Officer,
[Impersonated Third Party Company]
[Impersonated Third Party Address]
External Third Party Impersonation Debt Collection BEC Attack
This text-based BEC attack impersonates an external third party using a look-alike domain, debt collection theme, and overdue payment theme to request a fraudulent payment.
Hi,
I just set-up a new account and need to update the direct deposit information linked to my wages. Kindly assist in this regard.
Thank you.
Regards,
[Impersonated Executive Name]
[Impersonated Executive Title]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, display name spoofing, and a free webmail account to divert payroll deposits to a fraudulent account.
Hello,
We are pleased to send a friendly reminder to your accounting department regarding the due invoices and outstanding payment.
It would be much appreciated if you could let us know and advise when payment will be processed so that we can update you with our new bank details for remittance all payment as our main account is presently being reviewed due to some inconclusive L/C issue so therefore, all account activities including incoming and outgoing funds can no longer be verified at the moment.
Please, we request that you should attach us all invoices according to what your records show to revise with the correct payment instructions. We will appreciate it if all concerned people treat this as urgent.
Regards,
[Impersonated Vendor Employee Name]
Sales Director
Home
[Impersonated Vendor Company Name]
[Impersonated Vendor Address]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using display name spoofing, a maliciously registered domain, an overdue payment theme, and a payment account update theme to request a fraudulent payment.
Hi, I'm sorry but You're going to have a bad day:
Approximately few months ago I have gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.
Here is the sequence of events:
Some time ago I have purchased access to email accounts from hackers (nowadays, it is quite simple to purchase such thing online). Obviously, I have easily managed to log in to your email account, if you don't believe me, just see header of this email ;) One week later, I have already installed Trojan virus to Operating Systems of all the devices that you use to access your email.
In fact, it was not really hard at all (since you were following the links from your inbox emails).
This software provides me with access to all the controllers of your devices (e.g., your microphone, video camera and keyboard).
I have downloaded all your information, data, photos, web browsing history to my servers.
I have access to all your messengers, social networks, emails, chat history and contacts list.
My virus continuously refreshes the signatures (it is driver-based), and hence remains invisible for antivirus software.
Likewise, I guess by now you understand why I have stayed undetected until this email...
While gathering information about you, I have discovered that you are a big fan of adult websites. You really love visiting porn websites and watching exciting videos, while enduring an enormous amount of pleasure. Well, I have managed to record a number of your dirty scenes and montaged a few videos, which show the way you masturbate and reach orgasms. If you have doubts, I can make a few clicks of my mouse and all your videos will be shared to your friends, colleagues and relatives. I have also no issue at all to make them available for public access. I guess, you really don't want that to happen, considering the specificity of the videos you like to watch, (you perfectly know what I mean) it will cause a true catastrophe for you.
I've also a good news!
You transfer $ 1900 USD to me (in bitcoin equivalent according to the exchange rate at the moment of funds transfer), and once the transfer is received, I will delete all this dirty stuff right away. After that we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me, I keep my word.
This is a fair deal and the price is quite low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how buy bitcoin: 1) https://buy.chainbits.com/?crypto=BTC OR 2) https://buy.moonpay.com/
Here is my bitcoin wallet: 1Hf64aVtMHsvyjwkrtKsqXM1K4UcHZw94i
You have less than 48 hours from the moment you opened this email (precisely 2 days).
Things you need to avoid from doing:
- Do not reply me (I have created this email inside your inbox and generated the return address).
- Do not try to contact police and other security services. In addition, forget about telling this to you friends. If I discover that (as you can see, it is really not so hard, considering that I control all your systems) - your video will be shared to public right away.
- Don't try to find me - it is absolutely pointless. All the cryptocurrency transactions are anonymous.
- Don't try to reinstall the OS on your devices or throw them away. It is pointless as well, since all the videos have already been saved at remote servers.
Things you don't need to worry about:
- That I won't be able to receive your funds transfer.
- Don't worry, I will see it right away, once you complete the transfer, since I continuously track all your activities (my trojan virus has got a remote-control feature, something like TeamViewer).
- That I will share your videos anyway after you complete the funds transfer.
- Trust me, I have no point to continue creating troubles in your life. If I really wanted that, I would do it long time ago!
Everything will be done in a fair manner!
One more thing... Don't get caught in similar kind of situations anymore in future!
My advice - keep changing all your passwords on a frequent basis
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a fake malware infection theme to demand a payment.
Hi [Recipient First Name],
Going forward with your order, Before we can continue proceeding with your order. Be informed we have moved into the advanced age of billings. We are only set up to receive payments electronically via ACH/Wire Transfers. Do not use the previous information for remittance. it is now outdated.
Kindly let me know which you prefer in the above so we can proceed further with your PO.
Would so much appreciate your earliest confirmation
Regards,
[Vendor Employee Name]
[Vendor Employee Title]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, display name spoofing, and a payment account update theme to request a fraudulent payment.
Metamask requires all users to verify their wallets in order to comply with KYC regulations this must be done before 04/30/2022 as a regulated financial services company, we are required to verify all wallets on our platform. We require all customers to verify their wallets to continue using our service.
What if I do not complete the wallet verification?
If you do not verify your wallet, your wallet will be restricted.
Verify your wallet
Please keep in mind that our intention is to keep our customers safe and happy.
We thank you in advance for your understanding.
The MetaMask Team
Metamask Account Verification Credential Phishing Attack
This link-based attack impersonates Metamask using an account verification theme to steal credentials.
In order to serve you better now and in the future, First American has a Secure E-Mail system. As a result, all users will be prompted to register a user name and password the first time they access this system.
You have received an encrypted Secure E-Mail from the First American Financial Corporation or one of its subsidiaries that may contain private and/or sensitive data. If you have questions or concerns about this secure E-Mail Notification, please contact your First American representative. Always be on the lookout for phishing. Information on legitimate links and how to identify spoofed emails may be found on our website firstam.com by searching "phishing."
Click here to read your secure message, which expires 2022-05-03 11:59 PDT. Please save or export this message and any attachments to a separate system before the expiration to avoid losing this information.
More Info
First American Title Fake Document Credential Phishing Attack
This link-based attack impersonates First American Title using an external compromised account and fake document theme to steal credentials.
Hi ,
I changed my bank and I'll like to update my paycheck deposit details, can the change be effective for the current pay date? also can i send the new details to you now ?
[Executive Name].
Sent from my iPhone
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using a spoofed email address and a maliciously registered domain to divert payroll deposits to a fraudulent account.
Dear Customer,
Greetings and best wishes from us.
Please confirm the status of your Due/Outstanding Invoices for reconciliation purposes with the total amount and corresponding due dates as there has been a new development in our company.
Kindly hold off on payment till you get our new payment information from us.
Thank you in anticipation of your reply.
Best Regards,
[Impersonated Vendor Employee Name]
Accounting Manager
[Impersonated Vendor Website]
Vendor Impersonation Payment Inquiry BEC Attack
This text-based BEC attack impersonates a vendor/supplier using email address spoofing, a free webmail account, an overdue payment theme, and a payment account update theme to request a fraudulent payment.
