Attack Vault

Showing

results

The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.

This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.

Hello,[Target Company Name]

You made Txn of payment of $639.47 USD to CryptoManiaCM

DESCRIPTION

Date-Mon,20-Jun-2022

User-id : [Recipient Email Address]

Product name : Bitcoin locker

Invoice Id : GBURIT0485H1862

Instructions to seller : N/A

Sum : $639.47 USD

Account appearance will be delayed due to settlement procedure(25hrs)

If you feel this is not initiated by you then contact us.

Customer Service : (855_579)-2052

Yours Sincerely

Edward

PayPal Cryptocurrency Fake Payment Receipt Fake Billing Scam

Subject:

[Target Company Name]:/Invoice Id : GBURIT0485H1862

Attack Date:

June 20, 2022

This text-based fake billing scam impersonates PayPal using a personalized email subject, a free webmail account, a cryptocurrency theme, and a fake payment receipt theme.

No items found.

Type:

Fake Billing Scam

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Impersonated Party:

Impersonated Brand:

PayPal

Attachment Type:

Language:

See Attack Details

You Have A Document To Review And Sign.

REVIEW DOCUMENTS

Dear [Recipient Email Address]

Enclosed please find the original contract agreement for your signature. Please sign via Docusign . We will return a fully executed copy for your records upon completion of the agreement.

Sincerely,

Board Of Directors

DocuSign Fake Document Credential Phishing Attack

Subject:

Docusign Agreement

Attack Date:

June 20, 2022

This link-based attack impersonates DocuSign using a free webmail account and a fake document theme to steal credentials.

No items found.

Type:

Credential Phishing

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Credential Theft

Impersonated Party:

Impersonated Brand:

DocuSign

Attachment Type:

Language:

See Attack Details

I can access the employee portal but I keep getting an error message every time I try to modify my direct deposit information. Can I just forward you a voided check or my new account details for you to update before the next pay circle.

[Impersonated Employee Name]

[Impersonated Employee Title]

[Target Company Name]

Employee Impersonation Payroll Diversion BEC Attack

Subject:

earnings

Attack Date:

June 20, 2022

This text-based BEC attack impersonates an employee using a maliciously registered domain and a spoofed display name to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

PAST DUE LETTER

From : Matrix Debt Relief

======================================

Account Number: 8:23-HB-64361842-FDC

Outstanding Balance: $954.00

Creditor: US Cash Advance

At this time we have not yet received a payment in regards to Account 8:23-HB-64361842-FDC nor have we gotten a response to the letter sent before. Your account is now 1042 days past due and you owe a total of $954.00

As a valued customer, we would like to help you quickly remit payment to avoid any actions that could damage your credit rating or future credit limits with our company. If there is a reason you are unable to pay in full, please contact us and We would be happy to talk about arranging a payment schedule that is mutually agreeable.

Please get in touch with us immediately if you would like to work out a payment schedule, otherwise please submit your payment of $954.00 today. You can submit the payment, through our online payment portal.

After sending you this letter, we are required by law to turn your account over to an outside collector unless you contact us to make satisfactory payment arrangements. We do not like to do this; however, we will abide by the choice you make. If you have any questions, please Email us at : matrix.microrepayments@maildepot.net

Sincerely,

Staff Attorney, Matrix Debt Relief

Copies to:

Frank Rogers, County Administrator

Carl Cooper, County Attorney

Maria Fairchild, Public Safety

Note : It is possible that our previous emails fell through the cracks or delivered in spam because of words like (credit, loan, payment etc.)

This standard email footer is used to protect attorney-client privilege, which generally applies to communications between an attorney and their client, provided those communications are not disclosed to a third party (or made for the purpose of committing a crime or tort). This is one of the oldest recognized privileges for confidential communications. It is critical to the attorney-client relationship because it gives clients confidence, they can be forthright and their attorneys are then better able to provide candid and effective advice. The possibility of disclosure to a third party is the specific reason the disclaimer is included.

Matrix Debt Relief Debt Collection Legal Matter Fake Billing Scam

Subject:

Have You Seen This Past Due Invoice?

Attack Date:

June 18, 2022

This text-based fake billing scam impersonates Matrix Debt Relief using a debt collection theme and a legal matter theme.

No items found.

Type:

Fake Billing Scam

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Impersonated Party:

Impersonated Brand:

Matrix Debt Relief

Attachment Type:

Language:

See Attack Details

Hola [Recipient First Name]

Necesito que te encargues de una tarea rápida por mí. Responda con su número de WhatsApp y espere mi mensaje.

Gracias.

Spanish Executive Impersonation Gift Card Request BEC Attack

Subject:

UN MOMENTO

Attack Date:

June 17, 2022

This text-based Spanish-language BEC attack impersonates an executive using a WhatsApp number request, a spoofed display name, and a free webmail account to request the purchase of gift cards.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Gift Card Request

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

Spanish

See Attack Details

I'm in a Google seminar with the board of directors at the moment can't use my phone that's why I'm contacting you through here, I need you to help me pick something from the nearest store to you right now🙏

[Executive Name]

[Executive Title]

Executive Impersonation Gift Card Request BEC Attack

Subject:

[no subject]

Attack Date:

June 16, 2022

This text-based BEC attack impersonates an executive using a spoofed display name and a free webmail account to request the purchase of gift cards.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Gift Card Request

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Greetings!

Please check the documents as one document available via the link lower:

hXXps://drive[.]google[.]com/uc?export=download&id=1aljY2OitxCFTLJURYOKgUjB9FSvHxCK6&confirm=t

File password: E98346

Good morning!

My name is [Teacher Name] and I am one of the teacher liaisons for [School Name]'s School Advisory Council.

This is a group of stakeholders (community members, school staff, students, and families) who come together to discuss how to support our school community.

Attached is a flyer for our upcoming December meetings. The first, December 9th, will be held at 5pm virtually at this link: .

We hope yopu are able to join! Pleae do not hesitate to reach out to me if you have any questions!

Best,

[Teacher Name]

Fake Document Link-based Malware Attack

Subject:

Re: School Advisory Council

Attack Date:

June 16, 2022

This link-based attack impersonates an external third party using an external compromised account and a fake document theme to deliver malware.

No items found.

Type:

Malware

Theme(s):

...

Tactic(s):

...

Vector:

Link-based

Goal:

Malware Delivery

Impersonated Party:

External Party - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Good Afternoon,

We trust you have what is needed to process these invoices for payment.

Please note: We have recently changed banks and the previous account which you have on file has been closed, hence, all payments effective immediately will be made directly to our (Updated) ACH revised bank account in compliance with the policy of the company.

Please confirm if payment will be going out today or sometimes this week so we can forward the revised bank account details.

If you have any further queries, please don’t hesitate to contact me.

Please share acknowledgement in return email. Thank you!

[Impersonated Vendor Employee Signature]

From: [Impersonated Vendor Employee Name]

Sent: Monday, June 13, 2022 1:20 PM

To: [Hijacked thread recipients]

Cc: [Hijacked thread recipients]

Subject: [Hijacked thread original subject]

[Hijacked thread content]

Vendor Impersonation Account Update BEC Attack

Subject:

Outstanding invoices

Attack Date:

June 16, 2022

This text-based BEC attack impersonates a vendor/supplier using a hijacked email thread, a look-alike domain, a spoofed display name, and an account update theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

External Party - Vendor/Supplier

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hola nómina,

Me gustaría cambiar la cuenta de mi Nómina a una cuenta nueva y me

gustaría saber si será efectivo para el próximo pago?

Gracias

[Impersonated Employee Name]

[Impersonated Employee Title]

Spanish Employee Impersonation Payroll Diversion BEC Attack

Subject:

[no subject]

Attack Date:

June 15, 2022

This text-based Spanish-language BEC attack impersonates an employee using a spoofed display name and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

Spanish

See Attack Details

Attached is your direct deposit, which will be deposited on 6/15/2022. Note: A PDF viewer, such as Adobe reader, must be installed on your computer in order to view your stub.

https://achremitdatatbackdatingsource[.]s3[.]us-west-1[.]amazonaws.com/vendorportalpayment.html#[Recipient Email Address]#ZWtsaW5lQGl0cy5qbmouY29t])