Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hi [Recipient First Name],
I have recently changed banks, can you update my payroll direct deposit information? Previous account on record will be inactive few days before the next pay day.
Regards,
[Impersonated Employee Name]
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an employee using a spoofed email address and a free webmail account to divert payroll deposits to a fraudulent account.
[Recipient First Name],
How are you doing today, before this skip my mind today i think i will like to appreciate some of the staff with little incentive today, so i will like you to perform little task for me soon, let me know if you are available so that i can send you details.
Regards,
[Impersonated Employee Name]
Employee Impersonation Employee Incentive Gift Card Request BEC Attack
This text-based BEC attack impersonates an employee using a maliciously registered domain, a spoofed display name, and an employee incentive theme to request the purchase of gift cards.
Hallo Herr [Recipient Last Name],
Ich benötige Ihre Hilfe, um mich bei einer vertraulichen finanziellen Operation zu unterstützen.
Sind Sie heute verfügbar?
Mit freundlichen Grüßen
[Executive Name]
Von meinem Smartphone gesendet
German Executive Impersonation Payment Fraud BEC Attack
This text-based German-language BEC attack impersonates an executive using an extended spoofed display name and a maliciously registered domain to request a fraudulent payment.
[Recipient First Name],
Trebuie să trimitem astăzi o plată SEPA de €22,980.00 către Regatul Unit. De ce informații aveți nevoie pentru a finaliza acest transfer? poti plati azi
Salutari,
[Executive First Name]
Romanian Executive Impersonation Payment Fraud BEC Attack
This text-based Romanian-language BEC attack impersonates an executive using a spoofed email address and a free webmail account to request a fraudulent payment.
Hi,
It's Almost Weekend!
This email dated Wednesday June 22nd, 2022 has been scanned and is considered safe for viewing.
rcnE ypted liamE tfosorciM
You deviecer evah an liame detpyrcne from tfosorciM Safe ®srevreS .
1 document may be related.
Employee PayStub Registration.xlsx
Shown by Cortana
View email
Better with Microsoft Viva
The employee experience platform that brings it all together - empowering people and teams to be their best, from anywhere.
Microsoft Fake Document Credential Phishing Attack
This link-based attack impersonates Microsoft using a maliciously registered domain and a fake document theme to steal credentials.
Hello,
We would like to keep ACH payment setup; however, our receiving information has changed.
Kindly provide the Vendor update form.
[Impersonated Vendor Employee Name]
Accounts Receivable
[Impersonated Vendor Company Name]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, a spoofed display name, and an account update theme to request a fraudulent payment.
Hi [Recipient First Name],
Please follow up with the below payment request for a job completed; pay the attached invoice and let me know once completed.
Thanks,
[Executive Name]
[Executive Title]
[Target Company Name]
[Target Company Address]
---------- Forwarded message ---------
From: [Vendor Employee Name] <[Lookalike Vendor Employee Username]@gmail.com>
Date: Tue, Jun 21, 2022 at 5:01 PM
Subject: [Vendor Company Name] Invoice #15250
To: <[Executive Look-alike Email Address>
Good afternoon Sir,
Please find the invoice attached.
If you could submit this for processing at your earliest convenience it would be highly appreciated; our cash flow is tight.
Thank you very much.
[Vendor Employee Name]
[Vendor Employee Title]
[Vendor Company Name]
Executive Impersonation Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a fake email chain, a look-alike domain, and a spoofed display name to request a fraudulent payment.
New Secure Message from [Recipient Email Domain]
Open Message
To view the secure message for [Recipient Email Address], click Open Message.
The secure message expires on Jun 23rd, 2022 @ 09:11 AM (GMT).
Do not reply to this notification message; this message was auto-generated by the sender's security system. To reply to the sender, click Open Message.
If clicking Open Message does not work, copy and paste the link below into your Internet browser address bar.
[Recipient Email Domain]
Want to send and receive your secure messages transparently?
Click here to learn more.
Secure Message Credential Phishing Attack
This link-based attack uses a self-addressed spoofed email and a secure message theme to steal credentials.
FedEx No.3839
We've got a new message for you.
An email containing confidential personal information was sent to you.
FedEx No.3839
FedEx Secure Message HTML Attachment Credential Phishing Attack
This payload-based attack impersonates FedEx using a secure message theme to steal credentials.
Hello,
I'm [Vendor Employee First Name] from the Accounts department at [Vendor Company Name] Our records show that we owe an outstanding balance dating back to
04/05/2022
This email is to request you for a copy of your company account
Manager or Financial controller email contact, so that we can
clear the payment at the earliest. Sincere apologies for the
delay in payment. The accounts team has been reshuffled and this
case came to my notice just an hour ago and I am writing to you
immediately.
If this invoice has already been paid, please disregard this
notice.
Thank you in advance for your cooperation. We hope to continue
doing business with you in the future.
Sincerely,
[Vendor Employee Name]
[Vendor Employee Title]
[Vendor Company Name]
Vendor Impersonation Overdue Payment BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, a spoofed display name, and an overdue payment theme to request a fraudulent payment.
