Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hi [Target First Name],
I need you to take care of a payment to a Vendor today. Let me know if you can and what payment option you have so I can provide you with the information you need and the paperwork/invoice to process the payment.
Thanks
[Executive Name]
[Executive Title & Organization]
Executive Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing and a free webmail account to request a fraudulent payment.
Hi!
As you may have noticed, I sent you an email from your account. This means that I have full access to your account.
I’ve been watching you for a few months now.
The fact is that you were infected with njrat through an adult site that you visited.
If you are not familiar with this, I will explain.
Njrat gives me full access and control your device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence.
I made a video showing how you satisfy yourself in the left half of the screen, and in the right half you see the video that you watched.
With one click of the mouse, I can send this video to all your emails and contacts on social networks.
I can also post access to all your e-mail correspondence and messengers that you use.
If you want to prevent this,
transfer the amount of 1300 EURO to my bitcoin address (if you do not know how to do this, write to Google: “Buy Bitcoin”).
My bitcoin address (BTC Wallet) is: 1PBfPDTCirqxu36DYri2iKTjsEKLuzPCc
After receiving the payment, I will delete the video and you will never hear me again. I give you 48 hours to pay.
I have a notice reading this letter, and the timer will work when you see this letter.
Filing a complaint somewhere does not make sense because this email cannot be tracked like my bitcoin address. I do not make any mistakes.
If I find that you have shared this message with someone else, the video will be immediately distributed.
Best regards!
Fake Malware Infection Extortion Attack
This text-based extortion attack uses email spoofing and a fake malware infection theme to demand a payment.
Hi [Target First Name],
Quick one - I just switched my bank and would like to update my direct deposit details, would the change be effective for the next pay date, Kindly get back to me immediately you received my message so that i can provide you my new account ....
Regards,
[Employee Name]
[Employee Title & Company]
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates a non-executive employee using display name spoofing and a maliciously registered domain to divert payroll deposits to a fraudulent account.
One Time Password Authentication For Microsoft 365
Your password is set to expire on Tuesday, April 19, 2022.
User ID: [Target Email Address]
Please take immediate action to avoid being log out permanently.
Keep Same Password
Sincerely,
Microsoft Corporation
Microsoft Expired Account Credential Phishing Attack
This link-based attack impersonates Microsoft using an external compromised account and an expired account theme to steal credentials.
Good Day.
The following is the last warning.
I broke into your system thru the Wireless router you were linking to.
A few months prior, I easily accessed the devices that you utilized to get on the net.
All the info out of your electronics and devices was immediately replicated to my hosting space.
I can take advantage of all your mobile messengers, social media sites, e-mail, chats, & contact-list.
My malware continuously updates its signature (driver-type), for that reason it stays invisible to anti-virus applications.
I assume at this point you see, why I stayed quite until today
Whilst gathering information about yourself, I noticed you happen to be a huge follower of adult sites & more.
You really prefer to go to porno sites & view kinky video clips whilst getting an orgasmic pleasure.
I have already created a cam capturing videos of you wanking off.
A montage of the videos you're watching at the time and your self pleasure.
Your face is distinctly visible. I do not believe this sort of content would-be great for your profile.
I can certainly forward this video out to everybody who knows you.
I also have no problem with rendering all your private data open to public on the web.
I do believe you know what I'm talking about.
It'll be a real problem for you.
I'll be able to mess up your daily life forever.
I really feel that you seriously don't need this to take place.
Let's resolve it that way: you send me 1200 $ (dollars) thru Bitcoin equivalent at the time of financial transaction), and i'll right away delete all of your info from my web servers.
Afterward, we will just disregard each other.
My btc wallet address for transaction: bc1qvrczz2jwfvyvumsj8pgzqavmfh0mhrte6g64sn
If you don't know how to send cash & what exactly btc is. Simply just type in the Google "Get btc".
I provide you with 2 business days to send the money.
The timer started counting automatically after you read this email.
I will receive a notification the minute this e-mail is opened.
Do not aim to search for aid, as the wallet can not be traced, email the message is originating from & can't be followed also & created automatically, therefore there is no reason for texting me.
Don't attempt to contact the law enforcement & some other protection services, & if you choose to, your information will undoubtedly be posted.
Switching passwords in social network sites, e-mail, and devices isn't going to help you, as all the information is already saved to my computers.
Good luck & do not do something silly. Think about your own future.
Fake Malware Infection Extortion Attack
This text-based extortion attack uses a fake malware infection theme to demand a payment.
Dear [Recipient Username],
As already announced, The year's Wage increase will start in May of 2022
and will be paid out for the first time by August, with recalculation as of May.
View salary-increase-sheet-May-2022.Scan-103500010302022.pdf
You will be informed of the details in advance by letter from the HR department.
regards
[Recipient Domain] Management
OneDrive COVID-19 Employee Incentive Fake Document Credential Phishing Attack
This link-based attack impersonates OneDrive and an employee using a self-addressed spoofed email, a COVID-19 theme, an employee incentive theme, and a fake document theme to steal credentials.
[Recipient First Name],
Please email me all of our customer receivables' updated Aging statements, A/R Reports (due within the next 30 days and a month overdue), Invoice numbers or PO and customer's payable contact emails and phone numbers, I want to check it in my free time.
Thank you
[Executive Name]
Executive Impersonation Aging Report BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing to compromise aging reports.
Can I have a quick moment with you. I need a quick favor, I’m currently into the world of NFTs and I need to fund my ETH crypto account with $12k
0x814300a488440d5c283eC16eDF8DB5288ABab6D3
I will reimburse you later on .
Thanks
Regards
[Executive Name]
CEO
Executive Impersonation Cryptocurrency Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using display name spoofing and a cryptocurrency theme to request a fraudulent payment.
Message details attached.
Microsoft Fake Document HTML Attachment Credential Phishing Attack
This payload-based attack impersonates Microsoft using a personalized email subject, an HTML attachment, and a fake document theme to steal credentials.
HI [Recipient First Name],
I'm planning to surprise some of the staff with Gifts, Your confidentiality will be appreciated. However, I need you to get a purchase done, Email me once you get this .
[Executive Name]
Chief Executive Officer
sent from my mobile device.
Executive Impersonation Gift Card BEC Attack
This text-based BEC attack impersonated an executive using display name spoofing and a free webmail account to request gift cards.
