Attack Vault

Showing

results

The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.

This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.

Hi [Recipient First Name]

‍

I'm writing to inform you I haven't received payment for invoice number
003880012, which was due some months ago. I originally sent the invoice
on
September 27, 2021.Please let me know if you have any questions about
this
invoice. I'll call you tomorrow if I don't hear from you to ensure this
email reaches you.

‍

Thank you for your time!

‍

Best Regards,
[Impersonated Vendor Employee Name]
[Impersonated Vendor Company Name]

‍

Vendor Impersonation Overdue Payment BEC Attack

Subject:

Outstanding Invoice:. 003880012 Reminder !!!

Attack Date:

May 9, 2022

This text-based BEC attack impersonates a vendor/supplier using a look-alike domain and an overdue payment theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

External Party - Vendor/Supplier

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hello

‍

Just a quick notice to inform you that I would like to change my direct deposit information as I have changed my bank lately, please advise .

‍

Regards,

‍

[Impersonated Employee Name]

‍

Employee Impersonation Payroll Diversion BEC Attack

Subject:

New Direct Deposit Update

Attack Date:

May 9, 2022

This text-based BEC attack impersonates an employee using a spoofed email address and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

I need you to email me the Ag‌ing rep‌ort along with customer pay‍able cont‍act emails.

‍

Sent from my iPhone

Executive Impersonation Aging Report Compromise BEC Attack

Subject:

A/R

Attack Date:

May 9, 2022

This text-based BEC attack impersonates an executive using a spoofed display name and a free webmail account to request a copy of an aging report.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Aging Report Theft

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hello,

‍

We are pleased to send a friendly reminder to your accounting department regarding the due invoices and outstanding payment.

‍

It would be much appreciated if you could let us know and advise when payment will be processed so that we can update you with our new bank details for remittance all payment as our main account is presently being reviewed due to some inconclusive L/C issue so therefore, all account activities including incoming and outgoing funds can no longer be verified at the moment.

‍

Please, we request that you should attach us all invoices according to what your records show to revise with the correct payment instructions. We will appreciate it if all concerned people treat this as urgent.

‍

Regards,

[Impersonated Vendor Employee Name]
[Impersonated Vendor Employee Title]

[Impersonated Vendor Company Name & Address]

‍

Vendor Impersonation Overdue Payment Account Update BEC Attack

Subject:

[Impersonated Vendor Name]: Due Invoices

Attack Date:

May 9, 2022

This text-based BEC attack impersonates a vendor/supplier using a spoofed display name, a maliciously registered domain, an overdue payment theme, and an account update theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

External Party - Vendor/Supplier

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

[Recipient First Name],

‍

Please I need you to take care of a financial obligation for me in order to finalize an agreement with a partner. Let me know when you are available so i can forward you the EFT/Wire Transfer Instructions as received for processing.

‍

Regards.

‍

Executive Impersonation Payment Fraud BEC Attack

Subject:

Investment Assets

Attack Date:

May 9, 2022

This text-based BEC attack impersonates an executive using a spoofed display name and a maliciously registered domain to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Attachment available 09/05 20:47:40

Secured file shared with [Recipient Email Address]

This document will be deleted from our storage server on its given expiry date.
Payment Confirmation A2204040417_PG3QX2
To view the secure share file, Please download the attachment.

• Please do not reply to this email. Emails sent to this address will not be answered.
Sent from [Recipient Email Domain] Messaging.

‍

Microsoft Secure Message HTML Attachment Credential Phishing Attack

Subject:

[Target Company Name] EFT Payment Notification

Attack Date:

May 9, 2022

This payload-based attack impersonates Microsoft using an HTML attachment and a secure message theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Payload-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

Microsoft

Attachment Type:

HTML

Language:

See Attack Details

Dear User [Instagram User Name]

If you have received this email, your Instagram account has violated our community guidelines

When we reviewed your Instagram account based on recent reports, we noticed that Instagram has and does engage in behavior that violates Community guidelines. Your account may be deleted or blocked due to these behaviors. To avoid Deletion and blocking of your account, please go to the objection form within 48 hours by clicking the "Copyright Appeal Form" link and fill out the objection form. Please take care to fill the form with the correct information requested.

Inform; If you have two-step verification on your account when you fill out the form, remember to disable it within the 48 hour review period. If it stays on, the review cannot be done and your account will be deleted

Copyright Appeal Form

‍

Instagram Suspended Account Credential Phishing Attack

Subject:

Attack Date:

May 9, 2022

This link-based attack impersonates Instagram using a look-alike domain and a suspended account theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

Instagram

Attachment Type:

Language:

See Attack Details

Hello,
Are you available to handle an urgent payment transfer of $253,500 aso soon as possible ?

‍

Thanks,

‍

[Executive Name]
[Executive Title]
[Company Name]

‍

Executive Impersonation Payment Fraud BEC Attack

Subject:

Payment Request FYI

Attack Date:

May 9, 2022

This text-based BEC attack impersonates an executive using a spoofed display name and a free webmail account to request a copy of an aging report.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

[Recipient Email Domain] Cash Flow Statements has been shared with you

Hi [Recipient Email Address], Please see the attached Cash Flow Statements
icon [Recipient Email Domain] Cash Flow Statements.pdf
permission globe icon This link will work for [Recipient Email Address].
Open

‍

OneDrive Fake Document Credential Phishing Attack

Subject:

Cash Flow Statements has been shared with you.

Attack Date:

May 9, 2022

This link-based attack impersonates OneDrive using a spoofed email address and a fake document theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

OneDrive

Attachment Type:

Language:

See Attack Details

Hi [Recipient First Name],
What's the limit of wire transfer you can send out in a day? Do reply me ASAP as i need you to make both Domestic and International payment today

‍

Regards
[Executive Name]

‍

Sent from my iPhone

‍

Executive Impersonation Payment Fraud BEC Attack

Subject:

URGENT WIRE TRANSFER

Attack Date:

May 8, 2022

This text-based BEC attack impersonates an executive using a spoofed email address and a maliciously registered domain to request a fraudulent payment.