Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hi [Recipient Name],
I was just informed that we have an offer accepted by a new vendor which I have been negotiating for some time now. Are you able to process the payment ? so I can forward you a copy of the invoice and W9.
Regards,
[Impersonated Executive Name]
Sent from my iPhone
Executive Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing, a maliciously registered domain, and a new vendor theme to request a fraudulent payment.
Hi, I'm sorry but You're going to have a bad day:
Approximately few months ago I have gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.
Here is the sequence of events:
Some time ago I have purchased access to email accounts from hackers (nowadays, it is quite simple to purchase such thing online). Obviously, I have easily managed to log in to your email account, if you don't believe me, just see header of this email ;) One week later, I have already installed Trojan virus to Operating Systems of all the devices that you use to access your email.
In fact, it was not really hard at all (since you were following the links from your inbox emails).
This software provides me with access to all the controllers of your devices (e.g., your microphone, video camera and keyboard).
I have downloaded all your information, data, photos, web browsing history to my servers.
I have access to all your messengers, social networks, emails, chat history and contacts list.
My virus continuously refreshes the signatures (it is driver-based), and hence remains invisible for antivirus software.
Likewise, I guess by now you understand why I have stayed undetected until this email...
While gathering information about you, I have discovered that you are a big fan of adult websites. You really love visiting porn websites and watching exciting videos, while enduring an enormous amount of pleasure. Well, I have managed to record a number of your dirty scenes and montaged a few videos, which show the way you masturbate and reach orgasms. If you have doubts, I can make a few clicks of my mouse and all your videos will be shared to your friends, colleagues and relatives. I have also no issue at all to make them available for public access. I guess, you really don't want that to happen, considering the specificity of the videos you like to watch, (you perfectly know what I mean) it will cause a true catastrophe for you.
I've also a good news!
You transfer $ 1900 USD to me (in bitcoin equivalent according to the exchange rate at the moment of funds transfer), and once the transfer is received, I will delete all this dirty stuff right away. After that we will forget about each other. I also promise to deactivate and delete all the harmful software from your devices. Trust me, I keep my word.
This is a fair deal and the price is quite low, considering that I have been checking out your profile and traffic for some time by now. If you don't know how buy bitcoin: 1) https://buy.chainbits.com/?crypto=BTC OR 2) https://buy.moonpay.com/
Here is my bitcoin wallet: 1Hf64aVtMHsvyjwkrtKsqXM1K4UcHZw94i
You have less than 48 hours from the moment you opened this email (precisely 2 days).
Things you need to avoid from doing:
- Do not reply me (I have created this email inside your inbox and generated the return address).
- Do not try to contact police and other security services. In addition, forget about telling this to you friends. If I discover that (as you can see, it is really not so hard, considering that I control all your systems) - your video will be shared to public right away.
- Don't try to find me - it is absolutely pointless. All the cryptocurrency transactions are anonymous.
- Don't try to reinstall the OS on your devices or throw them away. It is pointless as well, since all the videos have already been saved at remote servers.
Things you don't need to worry about:
- That I won't be able to receive your funds transfer.
- Don't worry, I will see it right away, once you complete the transfer, since I continuously track all your activities (my trojan virus has got a remote-control feature, something like TeamViewer).
- That I will share your videos anyway after you complete the funds transfer.
- Trust me, I have no point to continue creating troubles in your life. If I really wanted that, I would do it long time ago!
Everything will be done in a fair manner!
One more thing... Don't get caught in similar kind of situations anymore in future!
My advice - keep changing all your passwords on a frequent basis
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a fake malware infection theme to demand a payment.
Hello,
We are pleased to send a friendly reminder to your accounting department regarding the due invoices and outstanding payment.
It would be much appreciated if you could let us know and advise when payment will be processed so that we can update you with our new bank details for remittance all payment as our main account is presently being reviewed due to some inconclusive L/C issue so therefore, all account activities including incoming and outgoing funds can no longer be verified at the moment.
Please, we request that you should attach us all invoices according to what your records show to revise with the correct payment instructions. We will appreciate it if all concerned people treat this as urgent.
Regards,
[Impersonated Vendor Employee Name]
Sales Director
Home
[Impersonated Vendor Company Name]
[Impersonated Vendor Address]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using display name spoofing, a maliciously registered domain, an overdue payment theme, and a payment account update theme to request a fraudulent payment.
Hi,
I just set-up a new account and need to update the direct deposit information linked to my wages. Kindly assist in this regard.
Thank you.
Regards,
[Impersonated Executive Name]
[Impersonated Executive Title]
Executive Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, display name spoofing, and a free webmail account to divert payroll deposits to a fraudulent account.
Hi [Target Name],
I am a Debt Recovery and Enforcement Officer at [Impersonated Third Party Company] I am representing a client in chasing an unpaid invoice #9784333 issued to your firm, I have been advised to contact you on this matter to get this resolved as soon as possible.
Thanks.
James Dinoi
Debt Recovery and Enforcement Officer,
[Impersonated Third Party Company]
[Impersonated Third Party Address]
External Third Party Impersonation Debt Collection BEC Attack
This text-based BEC attack impersonates an external third party using a look-alike domain, debt collection theme, and overdue payment theme to request a fraudulent payment.
Metamask requires all users to verify their wallets in order to comply with KYC regulations this must be done before 04/30/2022 as a regulated financial services company, we are required to verify all wallets on our platform. We require all customers to verify their wallets to continue using our service.
What if I do not complete the wallet verification?
If you do not verify your wallet, your wallet will be restricted.
Verify your wallet
Please keep in mind that our intention is to keep our customers safe and happy.
We thank you in advance for your understanding.
The MetaMask Team
Metamask Account Verification Credential Phishing Attack
This link-based attack impersonates Metamask using an account verification theme to steal credentials.
Hi [Recipient First Name],
Going forward with your order, Before we can continue proceeding with your order. Be informed we have moved into the advanced age of billings. We are only set up to receive payments electronically via ACH/Wire Transfers. Do not use the previous information for remittance. it is now outdated.
Kindly let me know which you prefer in the above so we can proceed further with your PO.
Would so much appreciate your earliest confirmation
Regards,
[Vendor Employee Name]
[Vendor Employee Title]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, display name spoofing, and a payment account update theme to request a fraudulent payment.
Dear Manager Accounts,
EUROCONTROL HEREBY REMINDS YOU OF THE UNPAID INVOICES WHICH HAS BEEN SENT TO YOU. WE ADVISED THAT YOU EXPEDITE ACTIONS NOW TO SETTLE THE
BILLS AS EARLY AS POSSIBLE SO THAT WE CAN CLOSE THIS FILE .THE PAYMENTS ARE OVERDUE NOW AND HENCE ,IT IS IMPORTANT THAT YOU TAKE THE NECESSARY ACTIONS AS SOON AS POSSIBLE TO MAKE PAYMENTS.
WE ALSO HEREBY,INFORM YOU OF THE CHANGE IN OUR ACCOUNT DETAILS FOR ALL EUROCONTROL PAYMENTS AS THE CASE MAY BE, FOR SPECIFIC TRANSACTIONS AND
AS DIRECTED BY THE MANAGEMENT. YOU ARE ADVISED TO INFORM US ADEQUATELY BEFORE ANY PAYMENTS ARE MADE SO THAT WE CAN PROVIDE YOU WITH THE NEW
ACCOUNTS.
PLEASE YOU ARE ADVISED TO CONFIRM THIS FROM US IMMEDIATELY.THE DETAILS WILL BE FORWARDED TO YOU IN GOOD TIME AS SOON AS WE RECEIVE YOUR
ADVISE. PLEASE TAKE NOTE,WE DO NOT WANT ANY MIX-UPS AND MISUNDERSTANDING AGAIN.
KINDLY CONFIRM RECEIPT OF THIS NOTICE BY PROMPT RESPONSE
WE APPRECIATE YOUR UNDERSTANDING AND ALWAYS COUNT ON YOUR COOPERATION.
Best Regards,
[Impersonated Third Party Name]
Assistant to the Treasurer
DR/PFO - Treasury Section
EUROCONTROL 96 Rue de la Fusee
1130 Brussels,Belgium.
External Third Party Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates an external third party using display name spoofing, a free webmail account, overdue payment theme, and payment account update theme to request a fraudulent payment.
Dear Colleagues & AP Team,
Please be informed that we have not yet received payment with respect to these invoices.
2/2111/01-2/2203/01 for Eurocontrol Belgium(Nov. to Dec., 2021 & Jan.-Mar 2022)
HE/2111/01-2/2203/01 for Eurocontrol Belgium Egypt(Nov. to Dec., 2021 & Jan.-Mar 2022)
UM/2111/01-2/2203/01 for Eurocontrol Belgium Belarus(Nov. to Dec., 2021 & Jan.-Mar 2022)
05/2111/01-2/2203/01 for Eurocontrol Belgium Netherlands(Nov. to Dec., 2021 & Jan.-Mar 2022)
IC/2111/01-2/2203/01 for Eurocontrol Belgium Ireland(Nov. to Dec., 2021 & Jan-Mar 2022) ETC.
You are hereby advised to settle these bills as soon as possible because some of the invoices are already in arrears. Also please advise if these payments have been remitted and kindly provide to us by return email the copy of the swift confirmation and proofs of payment , to enable us reconcile our accounts and to further advise you on future transactions and payments.We regret all inconveniences and plead that you bear with us.
Thanks for your cooperation. we await your prompt response.
My best regards
[Impersonated Third Party Name]
General Manager Accounts
Head of CAT / CO2 (Collection of Air Navigation Charges)
CRCO / CAT / CO2
EUROCONTROL
96 Rue de la Fusée, 1130 Brussels, Belgium
Email: [Impersonated Email Address]
External Third Party Impersonation Payment Inquiry BEC Attack
This text-based BEC attack impersonates an external third party using display name spoofing, a look-alike domain, and a payment inquiry theme to request a fraudulent payment.
Hello,
Can you please confirm with your accounting department if there's any due/unpaid invoices owed to our company, as we are currently switching to a new accounting software and a couple of invoices are missing? We apologize for the inconvenience, kindly attach any due/unpaid invoices with this email. I'll appreciate it if all concerned people treat this as urgent. Thanks.
Regards,
[Impersonated Vendor ExecutiveName]
Chief Executive Officer
[Impersonated Vendor Company]
[Impersonated Vendor Address]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using display name spoofing a maliciously registered domain, and an overdue payment theme to request a fraudulent payment.