Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
<p>Good Day,</p><p><br></p><p>We are currently reviewing our accounting system. Can I please get all the receivables by their due dates? This report should include their various email addresses in an excel spreadsheet.</p><p><br></p><p>How soon can you sort this ?</p><p><br></p><p>Treat as urgent.</p><p><br></p><p>Regards. </p>
Executive Impersonation Aging Report Theft BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, a maliciously registered domain, and a spoofed display name to request a copy of an aging report.
Good Morning,
As of 06/17/22, we have transitioned from Bank Of America to our Chase Bank. We are still receiving lock box/ACH payments into the Bank Of America account which will be permanently closed as of 06/27/22. Please confirm that you have updated your records to reflect the correct banking information listed in the letter attached. Sorry for any inconveniences this might cause.
Thanks!
[Vendor Employee Name]
[Vendor Employee Title]
[Vendor Company Name]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a spoofed email address, a look-alike domain, a personalized email subject, and an account update theme to request a fraudulent payment.
Good day!
You can look on a complete list of the needed documents here in one document:
hXXp://rsmzi[.]com/et/uiutsotsn
File password: U523
Hi [Impersonated Employee First Name],
This is received will revert soonest.
Regards
[Recipient Name]
¨"¨
From: [Impersonated Employee Name] <[Impersonated Employee Email Address]>
Sent: Tuesday, September 28, 2021 9:25 AM
To: [Hijacked Thread Recipients]
Subject: RE: AMENDED SALE AGREEMENT
[Hijacked Thread Contents]
Fake Document Link-based Malware Attack
This link-based attack impersonates an employee using a hijacked email thread, an external compromised account, a spoofed display name, and a fake document theme to deliver malware.
New Secure Message from [Recipient Email Domain]
Open Message
To view the secure message for [Recipient Email Address], click Open Message.
The secure message expires on Jun 23rd, 2022 @ 09:11 AM (GMT).
Do not reply to this notification message; this message was auto-generated by the sender's security system. To reply to the sender, click Open Message.
If clicking Open Message does not work, copy and paste the link below into your Internet browser address bar.
[Recipient Email Domain]
Want to send and receive your secure messages transparently?
Click here to learn more.
Secure Message Credential Phishing Attack
This link-based attack uses a self-addressed spoofed email and a secure message theme to steal credentials.
Hi [Recipient First Name],
Please follow up with the below payment request for a job completed; pay the attached invoice and let me know once completed.
Thanks,
[Executive Name]
[Executive Title]
[Target Company Name]
[Target Company Address]
---------- Forwarded message ---------
From: [Vendor Employee Name] <[Lookalike Vendor Employee Username]@gmail.com>
Date: Tue, Jun 21, 2022 at 5:01 PM
Subject: [Vendor Company Name] Invoice #15250
To: <[Executive Look-alike Email Address>
Good afternoon Sir,
Please find the invoice attached.
If you could submit this for processing at your earliest convenience it would be highly appreciated; our cash flow is tight.
Thank you very much.
[Vendor Employee Name]
[Vendor Employee Title]
[Vendor Company Name]
Executive Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a fake email chain, a look-alike domain, and a spoofed display name to request a fraudulent payment.
Hello,
We would like to keep ACH payment setup; however, our receiving information has changed.
Kindly provide the Vendor update form.
[Impersonated Vendor Employee Name]
Accounts Receivable
[Impersonated Vendor Company Name]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, a spoofed display name, and an account update theme to request a fraudulent payment.
Hi,
It's Almost Weekend!
This email dated Wednesday June 22nd, 2022 has been scanned and is considered safe for viewing.
rcnE ypted liamE tfosorciM
You deviecer evah an liame detpyrcne from tfosorciM Safe ®srevreS .
1 document may be related.
Employee PayStub Registration.xlsx
Shown by Cortana
View email
Better with Microsoft Viva
The employee experience platform that brings it all together - empowering people and teams to be their best, from anywhere.
Microsoft Fake Document Credential Phishing Attack
This link-based attack impersonates Microsoft using a maliciously registered domain and a fake document theme to steal credentials.
[Recipient First Name],
Trebuie să trimitem astăzi o plată SEPA de €22,980.00 către Regatul Unit. De ce informații aveți nevoie pentru a finaliza acest transfer? poti plati azi
Salutari,
[Executive First Name]
Romanian Executive Impersonation Payment Fraud BEC Attack
This text-based Romanian-language BEC attack impersonates an executive using a spoofed email address and a free webmail account to request a fraudulent payment.
I can access the employee portal but I keep getting an error message every time I try to modify my direct deposit information. Can I just forward you a voided check or my new account details for you to update before the next pay circle.
[Impersonated Employee Name]
[Impersonated Employee Title]
[Target Company Name]
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an employee using a maliciously registered domain and a spoofed display name to divert payroll deposits to a fraudulent account.
You Have A Document To Review And Sign.
REVIEW DOCUMENTS
Dear [Recipient Email Address]
Enclosed please find the original contract agreement for your signature. Please sign via Docusign . We will return a fully executed copy for your records upon completion of the agreement.
Sincerely,
Board Of Directors
DocuSign Fake Document Credential Phishing Attack
This link-based attack impersonates DocuSign using a free webmail account and a fake document theme to steal credentials.
