WyzGuys Tech Talk

Phishing Email Alerts

Catch of the Day: Quickbooks EFT Phish
Chef’s Special: Spearphishing Report
Also serving: ChatGPT Phish

Examples of clever phish that made it past my spam filters and into my inbox. Some are sent by clients or readers like you, and other reliable sources on the Internet.

You can send phishing samples to me at phish@wyzguys.com.

My intention is to provide a warning and show current examples of phishing scams, related articles, and education about how these scams and exploits work, and how to detect them in your inbox. If the pictures are too small or extend off the page, double clicking the image will display them in a photo viewer app.

Quickbooks EFT Phish

This arrived on Monday May 22 at 7:30, and I started working on this on May 23 about 9:00 am.  I waited too long and the exploit site and landing page were either blocked, disable, or taken down.  Here are the screen shots I was able to capture.

Here’s the email.  The attachment made it look like this would be a self-hosted landing page, but it turned out to be hosted elsewhere.  The sender address troy@hillbillybees.com is wrong for Quickbooks.

Here are the email headers

The download page.  All of this work was done using Kali Linux

The contents of the ZIP file

When I opened the HTM file, I receive an alert from Firefox

I wanted to bypass this alert and clicked ignore the risk but Google Safe Browsing blocked it a second time.  I was unable to successfully defeat the security features in order to view the forged landing page.

So I ran the URL through VIrustotal and got the expected results.

I will say the guys and gals in charge of providing threat analysis, reporting and security updates are doing a quick and splendid job detecting and removing these sorts of threats.

Spearphishing report: 50% of companies were impacted in 2022

Barracuda Networks found that spearphishing exploits last year worked to great effect and took days to detect.

Spearphishing is a sliver of all email exploits, but the extent to which it succeeds is revealed in a new study from cybersecurity firm Barracuda Networks, which analyzed 50 billion emails across 3.5 million mailboxes in 2022, unearthing around 30 million spearphishing emails. These findings are in the company’s new report about Spear-Phishing Trends.

While that proportion represents less than a tenth of a percent of all emails, half of the organizations the firm examined in the study, which includes findings from a survey of more than 1,000 companies, were victimized by spearphishing last year. A quarter had at least one email account compromised through an account takeover.   More…

ChatGPT users target of phishing attack

A phishing attack is claiming to be OpenAI and seeking email account credentials from ChatGPT users, according to researchers with Inky Technology. The attackers are employing the InterPlanetary File System, and Inky researchers say, “These attacks are resilient to takedowns because the phishing content exists on multiple nodes at the same time so phishing content is still active even if one node is targeted.”