Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Could you please advise when we can expect payment?
Thank you,
[Vendor Employee Name], CPA
Chief Financial Officer
PwC network.
PricewaterhouseCoopers LLP
411 Hamilton Boulevard
Peoria, Illinois 61602
United States
On Mon, May 2, 2022 at 8:23 AM [Target Company Executive Name] <send@omnicrosoft-sender-via-omnicrosoft-server.com> wrote:
[Recipient Name],
Could you please ACH arrange payment for this invoice today.
See below and attached.
---------- Forwarded message ---------
From: [Vendor Employee Name]<[Vendor Employee Username]@accounts-pwc.com>
Sent: Friday, April 29, 2022 10:14 AM
To: [Target Company Executive Name]
Cc: [Vendor Employee Name]<[Vendor Employee Username]@accounts-pwc.com>
Subject: PWC LLP: INVOICE# 001691134 PAYMENT DUE
A new invoice 001691134 has been generated and is attached for your
review and payment.
Please make payment via ACH (Automated clearing house). Bank
information is on the invoice.
If you are experiencing issues viewing the attached pdf via a mobile
device, please use your standard mail client or webmail.
Thank you,
[Vendor Employee Name], CPA
Chief Financial Officer
PwC network.
Vendor Impersonation Fake Email Chain BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a fake email chain, display name spoofing, and a look-alike domain to request a fraudulent payment.
Dear Customer:
We have temporarily prevented online access to your account.
For your security, chase safeguards your account when there is a possibility
that someone other than you is attempting to sign in.
For immediate access to your account, please Sеcurе Rеviеw.
Note: This may have happened because you're using a device you don't usually use or you cleared the cookies on your browser. (Cookies are how we remember you.
Additional information is required by administrator to complete this update process.
Thank you for helping us keep your account safe.
Sincerely,
Online Banking Team
Chase Suspicious Account Activity Credential Phishing Attack
This link-based attack impersonates Chase using suspicious account activity theme to steal credentials.
Hey!
Hope you are doing well!
I have recently changed banks and would like to have my direct deposit updated to my new bank account. Can you please ensure the change is effective immediately for the next pay date?
Thanks!
[Impersonated Executive Name]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using email address spoofing and a maliciously registered domain to divert payroll deposits to a fraudulent account.
Metamask requires all users to verify their wallets in order to comply with the new guidelines. You must verify your wallet before 3/5/2022 to continue using our service.
What if I don’t complete the wallet verification?
If you don’t verify your wallet, your wallet will be restricted.
Verify my wallet
Metamask Account Verification Cryptocurrency Credential Phishing Attack
This link-based attack impersonates Metamask using a maliciously-registered domain, an account verification theme, and a cryptocurrency theme to steal credentials.
Action Required: Closure of your Robinhood account
Hi,
Our systems recently identified charges that appear to be unauthorized by the customer, meaning that the owner of the account did not consent to these payments. This means that we can no longer accept payments for your account.
Refunds on card payments will be issued in 5 business days, although they may take longer to appear on the cardholder's statement. Please refer to your Dashboard for a list of the charges to be refunded. If there are insufficient funds on your account to cover any refunds, these refunds will not be processed and any outstanding funds will remain on your account.
What you can do
If you believe that we've made a mistake, we'd like to remedy the situation as quickly as possible. To help us effectively revisit your account, please complete the below verification form:
Complete verification
Once verification has been completed, we will re-review your account within 24-48 hours.
If you have any questions, please contact customer support. We're here to help.
- The Robinhood Team
Robinhood Account Verification Credential Phishing Attack
This link-based attack impersonates Robinhood using a spoofed email address and an account verification theme to steal credentials.
Your Package Waiting For Delivery
Dear Customer.
You have to put all the data from accurate information in order for us to reach your address to receive your package
Cost Delivery: 2.99$
Sincerely,
USPS USA
Check Your Package
USPS Fake Shipping Notification Credential Phishing Attack
This link-based attack impersonates USPS using a spoofed email account and a fake shipping notification theme to steal credentials.
Good Day,
I have attempted to contact you several times, but you have not responded; when will your outstanding be paid?
In addition, we have changed our ACH/Wire information to a new bank account.
Please inform me of the status of the payment.
Regards,
Vendor Impersonation Payment Fraud Overdue Payment Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using display name spoofing, a look-alike domain, an overdue payment theme, and a payment account update theme to request a fraudulent payment.
New Document Shared for Review!
From a Personal/Business Computer:
Open the enclosed attachment:
Note: the image above is only the first of the attached document.
To view more than the first page, Open the attachment or..
GoTo Documents
SharePoint Fake Document Credential Phishing Attack
This link-based attack impersonates SharePoint using an external compromised account and a fake document theme to steal credentials.
Hi,
Please pay the below payment as a same-day transfer and send me a copy of the payment as an attachment
Regards
-----Original Message-----
From: HMRC
Sent: Monday, September 07 ,2021 03:45 PM
To: Finance
Subject: DTA 2021 due Payment
Below are HMRC bank details to process payment for the 2021 corporation tax due by 08/08/2021. Kindly note that payment should be processed as CHAPS/Same day value payment.
Sort Code/Routine [Account Detail]
Acct No [Account Number]
Payment Ref 9796919229A00118A
Amount £12,740
Let me have the remittance receipt as an attachment.
Thank you,
[Impersonated Executive Name]
Executive Impersonation Fake Email Chain Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a fake email chain, display name spoofing, and a maliciously registered domain to request a fraudulent payment.
HR@[Recipient Company Domain] shared a folder with you.
Please upload your documents in the bonus folder for 2022. .
Bonus Payments 2022
This link will work for [Recipient Email Address]..
Open
Microsoft Employee Incentive Fake Document Credential Phishing Attack
This link-based attack impersonates Microsoft using email spoofing, an employee incentive theme, and a fake document theme to steal credentials.
