Attack Vault

Showing

results

The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.

This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.

Ciao [Recipient First Name]

‍

Spero che tu stia bene, al momento ho cambiato la mia banca e modificato i dettagli del mio conto stipendio. Questa modifica può avere effetto prima della data di pagamento corrente?

‍

Saluti
[Executive Name]

‍

Italian Executive Impersonation Payroll Diversion BEC Attack

Subject:

Modificare i dettagli del libro paga

Attack Date:

May 5, 2022

This text-based Italian-language BEC attack impersonates an executive using display name spoofing and a maliciously registered domain to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Check#6253

‍

Dear, Team

View attached Statements

Best regards,

[Impersonated Name]

[Impersonated Title]

[Impersonated Company Name]

[Impersonated Phone Numbers]

‍

The information contained in this transmission may contain privileged and confidential information, including patient information protected by federal and state privacy laws. It is intended only for the use of the person(s) named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution, or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

‍

Evernote Fake Payment Receipt Credential Phishing Attack

Subject:

View Attached Payment

Attack Date:

May 4, 2022

This link-based attack impersonates Evernote and an external third party using a fake attachment, compromised external account, and a fake payment receipt theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

External Party - Other

Impersonated Brand:

Evernote

Attachment Type:

Language:

See Attack Details

[First Name] has shared a document with you for loop:
[Address] - [Name]

VIEW DOCUMENT

Dotloop Fake Document Credential Phishing Attack

Subject:

Please review Payoff Authorization

Attack Date:

May 4, 2022

This link-based attack impersonates Dotloop using a fake document theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

Dotloop

Attachment Type:

Language:

See Attack Details

[Recipient First Name],

‍

We have engaged King & Spalding LLP to represent us in Project Vida which involves the acquisition of certain distressed assets. I need you to work with Daniel Crosby, the partner in charge, to resolve a time-sensitive matter by the close of business this week.

‍

Please let me know soonest by email when you are available later today and the best number to reach you at.

‍

Thanks.

[Executive Name]

Sent from my iPhone

‍

Executive Impersonation Legal Matter Payment Fraud BEC Attack

Subject:

Project Vida - Legal Matter

Attack Date:

May 4, 2022

This text-based BEC attack impersonates an executive using display name spoofing, a maliciously registered domain, and a legal matter theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hi,

‍

Do you mind giving me information on how to update my payroll direct
deposit, and also I will like to know when it would be effective as
soon as it is updated?

‍

Thanks.

[Recipient Name]

[Recipient Title]

[Recipient Company]

‍

Employee Impersonation Payroll Diversion BEC Attack

Subject:

[Recipient Company Name]

Attack Date:

May 4, 2022

This text-based BEC attack impersonates an employee using a personalized email subject, display name spoofing, and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hello,

‍

We want to update our accounting record for the previous months till date which has not yet been balanced. We are currently looking to clear all outstanding, due and open invoices and would like to request an up-to-date statement of our account showing all unpaid and outstanding invoices for our reference.

‍

Please send us as a reminder a copy of the invoice or the unpaid balance with the due dates for accounting purposes and do not make any payment without notifying us for confirmation.

‍

Best regards,
[VENDOR EMPLOYEE NAME]
CFO

‍

Vendor Impersonation Payment Inquiry BEC Attack

Subject:

Invoice Settlement Reminder

Attack Date:

May 4, 2022

This text-based BEC attack impersonates a vendor/supplier using email spoofing, a free webmail account, and a payment inquiry theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

External Party - Vendor/Supplier

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hi [Recipient First Name],

Please can you share with me a PDF or XL list of all our outstanding receivable invoice / aging report to date with contacts

Regards,
[Executive Name].

‍

Executive Impersonation Aging Report BEC Attack

Subject:

Report

Attack Date:

May 4, 2022

This text-based BEC attack impersonates an executive using display name spoofing and a maliciously registered domain to request a copy of an aging report.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Aging Report Theft

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hi [Recipient First Name],

‍

I would like you to be in charge of a matter that needs to be resolved with our appointed legal advisors within this week.

‍

Please let me know soonest by email if you can assist in this and I will provide you with more details.

‍

Best Regards,
[Executive Name]

‍

Sent From my Smartphone

‍

Executive Impersonation Legal Matter Payment Fraud BEC Attack

Subject:

Corporate Matters

Attack Date:

May 3, 2022

This text-based BEC attack impersonates an executive using email spoofing and a legal matter theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

What is the current available balance in the account? Do we have Zelle
attached to our bank accounts? I’ll need you to process an outgoing
payment today via Wire/ACH for an Operating Expenses (Networking
Activities Website Hosting and Program Services) which is due.

‍

Kindly let me know if you can get it done today so I can forward you
the details for the payment.

‍

Kind Regards
[Impersonated Employee Name]

‍

Sent from my iPhone

‍

Employee Impersonation Payment Fraud BEC Attack

Subject:

[Recipient First Name]

Attack Date:

May 3, 2022

This text-based BEC attack impersonates an employee using a personalized email subject, display name spoofing, and a free webmail account to request a fraudulent payment.