WyzGuys Tech Talk

Phishing Email Alerts

Catch of the Day: Mailbox Full Phish

Chef’s Special:  AitM Phish

Examples of clever phish that made it past my spam filters and into my inbox. Some are sent by clients or readers like you, and other reliable sources on the Internet.

You can send phishing samples to me at phish@wyzguys.com.

My intention is to provide a warning and show current examples of phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your inbox. If the pictures are too small or extend off the page, double clicking the image will display them in a photo viewer app.

Massive adversary-in-the-middle phishing campaign bypasses MFA and mimics Microsoft Office

Microsoft has already seen millions of phishing emails sent every day by attackers using this phishing kit. Learn how to protect your business from this AitM campaign.

[Bob says: I like Adversary in the Middle better than On Path Attack as the politically correct non-sexist replacement for Man in the Middle.]

Mailbox Full Phish

I’ve been more diligent about analyzing the phish I catch quickly, before the inevitable takedown.  This fish arrived at 4:20 am on March 31.  Also of the screen captures happened by 6:00 am.  The Reduce Mailbox Size button resolved to https://owa0i001.web.app/ which is a public service available from Firebase Hosting.  Here’s the email

The email domain is for davisacura.com which looks like a car dealer to me.  Here are the email headers

Clicking the link lead to this credential stealing landing page

Virustotal did not report this link as malicious yet, but it appears I may have been the first to report this link.

Viewing the Details tab gave us the IP address of the server 199.36.158.100

This appears to be a Google property.  Many exploits like this one use publicly available hosting services.  These are often cleaned up within hours of their creation, but the adversaries must get enough usable responses for this to be worthwhile.