Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
[Recipient First Name],
Do you have a moment? I need you to send me the 2021 W-2 (PDF) and earnings summary of all employees. I need these via email immediately for a quick review.
Thanks,
[Executive Name]
Executive Impersonation W-2 Theft BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, display name spoofing, and a maliciously registered domain to steal employee W-2s..
Hello,
Please see attached and let me know if you have any question.
Thanks!
Vendor Impersonation Fake Invoice Credential Phishing Attack
This link-based attack impersonates a vendor/supplier using a fake attachment, compromised external account, and a fake invoice theme to steal credentials.
Please see attached for a copy of your new monthly support invoice. If there are any questions or concerns, please feel free to contact me at any time.
Thanks,
Fake Invoice HTML Attachment Credential Phishing Attack
This link-based attack impersonates a vendor/supplier using a compromised external account and a fake invoice theme to steal credentials.
Hello,
An invoice is due for payment which involves the acquisition of consulting services to develop efficient operations systems to meet our needs. What do you need to pay new vendors via ACH today?
Keep me in the loop,
Many thanks
[Executive Name]
[Executive Title]
[Company Name]
Executive Impersonation New Vendor Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing, a free webmail account, and a new vendor theme to request a fraudulent payment.
Hello,
I'll be needing your assistance.
I need to know if you are available at the moment.
Kindly reply with your personal cell#, I need a task done as soon as possible and look forward to my text.
Thanks.
Executive Impersonation Gift Card BEC Attack
This text-based BEC attack impersonates an executive using a cell phone request and email spoofing to request the purchase of gift cards.
Dear [Recipient Email Address] , 755748722657
Today 5/3/2022-21:25:12 Meta suspend your facebook account. [322306995]
How to fix a suspended account: [30328459073870]
Start Now
Ref: 146102106175
Facebook Suspended Account Credential Phishing Attack
This link-based attack impersonates Facebook using a free webmail account and a suspended account theme to steal credentials.
Hi [Recipient First Name],
Has payroll been completed? I received a new account today, what information would you need to update my direct deposit account?
Regards,
[Impersonated Employee Name].
Get Outlook for iOS
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an employee using a personalized email subject, display name spoofing, and a free webmail account to divert payroll deposits to a fraudulent account.
EFT Payment Copy For [Recipient Email Address]
Payment Remittance on May 3, 2022
DOWNLOAD
Attached is the payment copy for: EFTPymnt#0503
FileType :- PDF/HTML
Pages :- 2
Fake Payment Receipt Credential Phishing Attack
This link-based attack uses a fake payment receipt theme to steal credentials.
Hello!
Unfortunately, I have some unpleasant news for you.
Roughly several months ago I have managed to get a complete access to all devices that you use to browse internet.
Afterwards, I have proceeded with monitoring all internet activities of yours.
You can check out the sequence of events summarize below:
Previously I have bought from hackers a special access to various email accounts (currently, it is rather a straightforward thing that can be done online).
Clearly, I could effortlessly log in to your email account as well ([Recipient Email Address]).
One week after that, I proceeded with installing a Trojan virus in Operating Systems of all your devices, which are used by you to login to your email.
Actually, that was rather a simple thing to do (because you have opened a few links from your inbox emails previously).
Genius is in simplicity. ( ~_^)
Thanks to that software I can get access to all controllers inside your devices (such as your video camera, microphone, keyboard etc.).
I could easily download all your data, photos, web browsing history and other information to my servers.
I can access all your social networks accounts, messengers, emails, including chat history as well as contacts list.
This virus of mine unceasingly keeps refreshing its signatures (since it is controlled by a driver), and as result stays unnoticed by antivirus software.
Hereby, I believe by this time it is already clear for you why I was never detected until I sent this letter...
While compiling all the information related to you, I have also found out that you are a true fan and frequent visitor of adult websites.
You truly enjoy browsing through porn websites, while watching arousing videos and experiencing an unimaginable satisfaction.
To be honest, I could not resist but to record some of your kinky solo sessions and compiled them in several videos, which demonstrate you masturbating and cumming in the end.
If you still don't trust me, all it takes me is several mouse clicks to distribute all those videos with your colleagues, friends and even relatives.
In addition, I can upload them online for entire public to access.
I truly believe, you absolutely don't want such things to occur, bearing in mind the kinky stuff exposed in those videos that you usually watch, (you definitely understand what I am trying to say) it will result in a complete disaster for you.
We can still resolve it in the following manner:
You perform a transfer of $1590 USD to me (a bitcoin equivalent based on the exchange rate during the funds transfer), so after I receive the transfer, I will straight away remove all those lecherous videos without hesitation.
Then we can pretend like it has never happened before. In addition, I assure that all the harmful software will be deactivated and removed from all devices of yours. Don't worry, I am a man of my word.
It is really a good deal with a considerably low the price, bearing in mind that I was monitoring your profile as well as traffic over an extended period.
If you still unaware about the purchase and transfer process of bitcoins - all you can do is find the necessary information online.
My bitcoin wallet is as follows: 1MW4maqRuqi62YiRNMaBiHT65WJJMEAvQw
You are left with 48 hours and the countdown starts right after you open this email (2 days to be specific).
Don't forget to keep in mind and abstain from doing the following:
> Do not attempt to reply my email (this email was generated in your inbox together with the return address).
> Do not attempt to call police as well as other security services. Moreover, don't even think of sharing it with your friends. If I get to know about it (based on my skills, that would be very easy, since that I have all your systems under my control and constant monitoring) - your dirty video will become public without delay.
> Don't attempt searching for me - it is completely useless. Cryptocurrency transactions always remain anonymous.
> Don't attempt reinstalling the OS of your devices or even getting rid of them. It is meaningless too, because all your private videos are already been available on remote servers.
Things you should be concerned about:
> That I will not receive the funds transfer you make.
Relax, I will be able to track it immediately, after you complete the funds transfer, because I unceasingly monitor all activities that you do (trojan virus of mine can control remotely all processes, same as TeamViewer).
> That I will still distribute your videos after you have sent the money to me.
Believe me, it is pointless for me to proceed with troubling you after that. Besides that, if that really was my intention, it would happen long time ago!
It all will be settled on fair conditions and terms!
One last advice from me... Moving forward make sure you don't get involved in such type of incidents again!
My suggestion - make sure you change all your passwords as often as possible.
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a fake malware infection theme to demand a payment.
Hi [Recipient First Name],
I need your assistance, I want to update my account information on the payroll system. Kindly send me a direct deposit authorization form. I'd also like to know the pay date the change will go into effect
Thanks!
[Impersonated Employee Name]
[Impersonated Employee Title]
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an employee using an external compromised account to divert payroll deposits to a fraudulent account.
