Attack Vault

Showing

results

The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.

This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.

Citrix Attachments

Attorney engagement letter.pdf

204.3 KB

BC Inv Bylaws-executed.pdf

4.5 MB

BC Investments Corp - Certificate of Filing &...ion.pdf

493.7 KB

Earnest Money Contract.pdf

6.9 MB

Download Attachments

Caliber Home Loans Real Estate Transaction Fake Document Credential Phishing Attack

Subject:

##LOAN DOCUMENT 019191921

Attack Date:

May 6, 2022

This link-based attack impersonates Caliber Home Loans using an external compromised account, a real estate transaction theme, and a fake document theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

Caliber Home Loans

Attachment Type:

Language:

See Attack Details

Dear Pam

HELPDESK: 1-888-314-2079

BILLING DATE: May/06/2022

INVOICE ID: PP38165246

PAYMENT MODE AUTO DEBITED: ACCOUNT / CARD

Thanks for choosing Office 365 Suite. Kindly find the renewal details for Microsoft Office 365 and Online OneDrive renewal.

License Period: May/06/2022 – May/05/2023

Description

‍

Microsoft Office 365 (5 Devices)

Items

Rate

Qty

Amount

Microsoft Office 365 License

$149.99

OneDrive Cloud Storage (1 TB)

$124.99

Subtotal

$274.98

Tax (9%)

$24.75

Total

Paid Amount
‍

$299.73

‍

$299.73

Your license is activated. It will take some time for this transaction to show up in your account. If you do not wish to renew or pay $299.73, please follow the steps below to cancel your Subscriptions/Plan.

Call us on 1-888-314-2079 (Toll free) and speak to an advisor for the refund.

Thank You,

Customer Care

Helpline Number: 1-888-314-2079

Microsoft Subscription Renewal Fake Billing Scam

Subject:

Your Office 365 has been renewed.

Attack Date:

May 6, 2022

This text-based fake billing scam impersonates Microsoft using a subscription renewal theme.

No items found.

Type:

Fake Billing Scam

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Impersonated Party:

Impersonated Brand:

Microsoft

Attachment Type:

Language:

See Attack Details

SharePoint Fake Document Credential Phishing Attack

Subject:

Updated Financial Reports

Attack Date:

May 6, 2022

This link-based attack impersonates SharePoint using content obfuscation via image, a spoofed email address, and a fake document theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

SharePoint

Attachment Type:

Language:

See Attack Details

May 06, 2022

Name: [Recipient Name]
Account#:BK/3926392L

Lender: Cash Advance Inc. (PaydayLoan)
Total outstanding:$780.00

Settlement amount to be paid by today: 523.00

Dear [Recipient First Name]
With this email you are being notified about your account with National Credit Collections which will be declared as FLAT REFUSAL and will be treated legally through your district courthouse.

We are in the process of closing all the pending accounts. In this regard, we are providing you a final opportunity to settle your account immediately before it's too late to take action.

Your account is in final collections so we won't be able to provide you any documentation at this moment. If requested, we can send you an invoice pertaining to this account.

If interested in resolving this account without any legal action, then respond to this email or send us an email at your earliest convenience.

Thank you and have a nice day.

Lisa Vaughn
NCC Inc
Credit Settlement Department
credit.settlement@nccsolutionsusa.com

‍

Debt Collection Legal Matter Fake Billing Scam

Subject:

[Recipient Name]

Attack Date:

May 6, 2022

This text-based fake billing scam uses a personalized email subject, a debt collection theme, and a legal matter theme.

No items found.

Type:

Fake Billing Scam

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Impersonated Party:

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Greetings,

‍

I just different to another bank and I might want to refresh my Direct
store subtleties, will it be successful for the following Payroll?
Yet, if the
next finance has been planned, my old record is as yet open to get it
yet in the event that it has not been booked, generously assist me
with changing to this new data.

‍

Here is my new Direct Deposit Information.

‍

Directing #: [Routing Number]
Account #: [Account Number]
Account Type: Checking
Bank name: Cross River Bank

‍

If it's not too much trouble, let me in on when the change has been
made and sympathetically recognize the receipt of this message.

‍

Much obliged

‍

Employee Impersonation Payroll Diversion BEC Attack

Subject:

Account Information Changed

Attack Date:

May 6, 2022

This text-based BEC attack impersonates an employee using a spoofed email address and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

[Recipient First Name],

Ich möchte das Konto auf meiner Gehaltsabrechnung auf ein neues Konto ändern. Ich würde auch gerne wissen, wann es für die nächste Gehaltsabrechnung gültig wäre.

‍

Danke,

‍

[Impersonated Employee Name]
[Impersonated Employee Title]

‍

German Employee Impersonation Payroll Diversion BEC Attack

Subject:

DIREKTES EINZAHLUNGS-UPDATE

Attack Date:

May 6, 2022

This text-based German-language BEC attack impersonates an employee using display name spoofing and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hi [Recipient First Name]

‍

Are you free at the moment? Get back to me as soon as you can.

‍

Thanks.
[Executive Name]
Chief Executive Officer

‍

Sent from iCloud

‍

Executive Impersonation Gift Card Request BEC Attack

Subject:

[Target Company Name] [Target Company City/State]

Attack Date:

May 6, 2022

This text-based BEC attack impersonates an executive using a personalized email subject, a spoofed display name, and a free webmail account to request the purchase of gift cards.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Gift Card Request

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

This invoice is for the billing period May 05.

Greeting from Microsoft Service, we�re writing to provide you with an electronic invoice for your use of Microsoft service. Additional information regarding your bill, individual service charge details, and your account history are available on the account activity page.

Customer Id:225222819

Email:[Recipient Email Address]

Date : Thursday, 05-05-2022

Hello,

We would much appreciate if you could let us know the status of this Micorosoft service. Please do not hesitate to call us if you have any questions about the balance due on your account if you have already sent us your payment. Contact +1(845-789-5291)

ORDER CONFIRMATION

Total

Next Generation Windows Defender

Windlow 11 Advanced Threat Protection

$199.00

$149.00

Discount

Total

$340.00

Microsoft Account

Thank you for using our services

Get 20% OFF on your next order

Microsoft Fake Billing Scam

Subject:

Order Confirmation

Attack Date:

May 5, 2022

This text-based fake billing scam impersonates Microsoft using a fake payment receipt theme.

No items found.

Type:

Fake Billing Scam

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Impersonated Party:

Impersonated Brand:

Microsoft

Attachment Type:

Language:

See Attack Details

Hello,

I would like to inform you that my current bank details on my profile has been closed due to some personal reason, so am getting a replacement for it which i want to have it updated for my next Paychex.

Thank you,
[Impersonated Employee First Name]

Employee Impersonation Payroll Diversion BEC Attack

Subject:

Modify Adjure

Attack Date:

May 5, 2022

This text-based BEC attack impersonates an employee using display name spoofing and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

CFO.
Are we able to remit funds out today before the cut off time and what is our daily limit for a wire? Kindly let me know so I can provide you with the details for payment. Thanks

Sent from my iPhone

‍